Is there a flag to go mod tidy that'll let it report whether things are tidy without doing any network requests?

Because we're increasingly blocking outbound network access on builders.

But we do allow GOPROXY access, which we set, so if it needs that, I suppose that's okay.

There's not a simple way to do that, but it's a common feature request we should implement. I'm sure there is an issue filed somewhere.

go list -mod=readonly -test ./... would probably be good enough to check that we don't need to add new modules. Setting GOPROXY=off disables most requests, but the ?go-get=1 requests for resolving import paths don't go through the proxy, so those would still happen for unknown modules. Edit: resolving import paths actually does go through GOPROXY.

There's not a simple way to do that, but it's a common feature request we should implement. I'm sure there is an issue filed somewhere.

If that's on the way, I'd rather wait for that.

Cross-reference the two bugs when you find it?

#27005 would add a -check flag. go mod tidy would exit non-zero if changes are needed.

I don't think we'll have time to implement it before the freeze though.

Note that go list -mod=readonly -test ./... will only check that you don't need to add new modules given the build configuration of the environment that ran the command -- it will not flag any new modules that may be required when using different build tags (OS/arch/etc.). I believe that mod tidy -check (or an equivalent) is the only way to definitively guarantee that the go.mod and go.sum are in the proper state for all possible consumers.