Vendoring dependencies in release branches

Reasons

Our release branches are in the form "release/[version-number]". Every release is tagged from such a branch. We want to be able to reproducibly build them in any point of time. Due to particularities in the Go the only way to achieve this is by keeping the source of the dependencies in you own source tree, which is called vendoring from now on.

Tools

We use govendor and we are satisfied with it at the current point in time. It makes use of the GO15VENDOREXPERIMENT and keeps all dependencies in vendor/ while keeping the original source intact.

The tools and the whole process was proposed and agreed on in issue #146.

Initial vendoring

The govendor tool can list all external packages and create the vendor/ directory populated with their version from current $GOPATH. This should be done once when creating a new release branch.

govendor init # just init
govendor list +external #list all the packages which will be 
#vendored so that some specific version could be checkout if wanted
...
# do some checking out of external packages
...
govendor update +external # vendor all external packages
git add vendor
git commit -m "vendor packages before release/vX.Y.Z"

Updating all

At any point in time, a new point release may be created by updating the vendored dependencies.

go get -u
govendor update +external
git add vendor/*
git commit -m "Update vendored packages"

Updating a particular package

Updating dependencies may be done one by one. Lets say we want to update the package package/include/name to its latest version. First, make sure to update the source of the package in your local $GOPATH directory. Maybe by

cd "$GOPATH/src/package/include/name"
git pull

Then, go to the nedomi release branch and do the following:

govendor update package/include/name
git add vendor/*
git commit -m "Update a single vendored packages"

Building from a release branch

In order to use the vendored packages while building an release branch, make sure that your GO15VENDOREXPERIMENT is set to 1. Our Makefile in the release branches exports this variable before building, so if you just do

cd $GOPATH/src/github.com/ironsmile/nedomi
git co relase/0.1
make

you will get nedomi built with the vendored dependencies.