Running diff -qr <(sort vendor.orig/modules.txt) <(sort vendor/modules.txt) caused it to report no differences between the files, so it appears the ordering was different.

Different in what way? (Which modules were transposed, and does one of them transitively depend on the other?)

Change https://golang.org/cl/140862 mentions this issue: cmd/go/internal/mvs: document that BuildList is sorted

It appears that the BuildList itself is sorted. If there is any nondeterminism, it likely comes from concurrent import scanning, but I haven't been able to reproduce it in a unit-test so far.

I'll work on a reproducer for this today. If it helps you, it seems to occur for me when I use go mod vendor on a Mac, then I run it again within the golang:1.11 image in Docker (so on Linux). The version of 1.11.0 or 1.11.1 don't seem to make a difference.

Ah. If you repeatedly run go mod vendor on a single platform, do you get consistent results?

Yes, I think I do.

I'll attempt to verify with an example on a public repo when I can today or at least get more information on the difference in the private repo.

I tried to produce a test to reproduce this and I found a combination of user-failure/a potentially additional command as needed.

The reason why I got the failure is because as part of CI, we were doing this:

$ cp -a vendor/ vendor.orig/
$ go mod vendor

When I copy vendor to another directory, it becomes part of the current project in some way and it starts resolving all of the vendored dependencies as if they were part of the current project. So I think my initial issue is wrong as that's user failure.

But, the reason why we do that is because in our CI, the place where we run that doesn't have git. We commit our vendor directory and we want to ensure our vendor directory is correctly committed. Our CI doesn't have git at this point, so I copied the vendor directory to contain it. It doesn't appear like there's a way to validate the vendor directory similar to dep check.

Am I missing a command or should I create a separate issue for that?

From go help packages:

Directory and file names that begin with "." or "_" are ignored
by the go tool, as are directories named "testdata".

_vendor.orig or .vendor.orig should keep go from thinking the copies are part of the project.

It doesn't appear like there's a way to validate the vendor directory similar to dep check.

I think that's #27348.

Closing, on the theory that @mark-rushakoff's workaround should address your immediate needs and #27348 should provide a longer-term solution.

Please let me know if there are any other parts that we need to keep track of.