Go datasource can't resolve source URL without direct access to vanity import domain

[felipecrs]

Tell us more.

Renovate resolves a Go module's source/repository URL by performing an additional request to <module>?go-get=1 directly and scraping the go-import/go-source meta tags (e.g. https://k8s.io/kubernetes?go-get=1). This requires the Renovate environment to have access to that domain. On a locked-down/firewalled network (only GOPROXY egress allowed, no direct internet), that request never succeeds, so sourceUrl stays unset. That is the case for k8s.io/*, go.opentelemetry.io/* and any other vanity import path.

The main issue is that the built-in monorepo:kubernetes preset, which groups dependencies by matchSourceUrls, simply won't work. The same for group:opentelemetry-go. Without a resolved source URL, the dependencies silently never groups.

But I think there's a nice way to fix this.

The Go module proxy protocol already carries this data: the @latest (and @v/<version>.info) endpoint on GOPROXY returns an Origin field with the real VCS type and URL whenever the proxy resolved the module from git (reference). Renovate already talks to GOPROXY for version listing, we just need to extract the data (no new dependency, no extra request (one less request, in fact), and no direct access to the vanity domain needed).

We could make it so Renovate only checks https://k8s.io/kubernetes?go-get=1 in case https://proxy.golang.org/k8s.io/api/@latest doesn't yield a result. Or maybe not even that is necessary.

What do you think?

[felipecrs]

I proposed a PR for this:

• fix(datasource/go): resolve sourceUrl from GOPROXY Origin #44902