List all dependencies that appear in go.mod

* Update CHANGELOG and fix typo
* Render severity based on exit code
* Explicitly specify the default GOPROXY
* Default to -mod=readonly and allow override
* Do not modify `vendor` directory if it exists.
* Skip `go mod tidy` to prevent modifying projects files.
* Include dependencies that appear in go.mod but are not present in the
  vendor directory.
* Remove severity from log output
* Wipe golang module cache before each spec

```plaintext
The -mod build flag provides additional control over updating and use of
go.mod.

If invoked with -mod=readonly, the go command is disallowed from the
implicit automatic updating of go.mod described above. Instead, it fails
when any changes to go.mod are needed. This setting is most useful to
check that go.mod does not need updates, such as in a continuous
integration and testing system. The "go get" command remains permitted
to update go.mod even with -mod=readonly, and the "go mod" commands do
not take the -mod flag (or any other build flags).

If invoked with -mod=vendor, the go command loads packages from the main
module's vendor directory instead of downloading modules to and loading
packages from the module cache. The go command assumes the vendor
directory holds correct copies of dependencies, and it does not compute
the set of required module versions from go.mod files. However, the go
command does check that vendor/modules.txt (generated by 'go mod
vendor') contains metadata consistent with go.mod.

If invoked with -mod=mod, the go command loads modules from the module
cache even if there is a vendor directory present.

If the go command is not invoked with a -mod flag and the vendor
directory is present and the "go" version in go.mod is 1.14 or higher,
the go command will act as if it were invoked with -mod=vendor.
```

- https://golang.org/cmd/go/#hdr-Maintaining_module_requirements

1 files changed, 47 insertions, 13 deletions

diff --git a/spec/integration/go/modules_spec.rb b/spec/integration/go/modules_spec.rb
index 66dadb0..3be04af 100644
--- a/spec/integration/go/modules_spec.rb
+++ b/spec/integration/go/modules_spec.rb
@@ -1,6 +1,12 @@
 require 'spec_helper'
 
 RSpec.describe "modules" do
+  before do
+    # Delete go module cache
+    system('rm -fr ~/.local/pkg')
+    system('rm -fr /opt/asdf/installs/golang/**/packages/pkg/')
+  end
+
   include_examples "each report version", "go", "modules"
 
   ['1.11', '1.12', '1.13', '1.14'].each do |version|
@@ -14,15 +20,15 @@ RSpec.describe "modules" do
         runner.add_file('.tool-versions', "golang #{version}")
       end
 
-      specify { expect(subject).to match_schema }
-      specify { expect(subject[:licenses]).not_to be_empty }
-
       specify do
+        expect(subject).to match_schema
+        expect(subject[:licenses]).not_to be_empty
         expect(subject.dependency_names).to match_array([
+          "cloud.google.com/go",
           "github.com/davecgh/go-spew",
           "github.com/dimfeld/httptreemux/v5",
-          "github.com/golang/protobuf",
           "github.com/go-logfmt/logfmt",
+          "github.com/golang/protobuf",
           "github.com/google/uuid",
           "github.com/pmezard/go-difflib",
           "github.com/stretchr/objx",
@@ -30,17 +36,17 @@ RSpec.describe "modules" do
           "golang.org/x/net",
           "golang.org/x/oauth2",
           "golang.org/x/sync",
+          "golang.org/x/text",
           "google.golang.org/appengine",
           "gopkg.in/check.v1",
           "gopkg.in/yaml.v2"
         ])
+        expect(subject.licenses_for('github.com/dimfeld/httptreemux/v5')).to match_array(['MIT'])
+        expect(subject.licenses_for('github.com/go-logfmt/logfmt')).to match_array(['MIT'])
+        expect(subject.licenses_for('github.com/google/uuid')).to match_array(['BSD-3-Clause'])
+        expect(subject.licenses_for('github.com/stretchr/testify')).to match_array(['MIT'])
+        expect(subject.licenses_for('golang.org/x/oauth2')).to match_array(['BSD-3-Clause'])
       end
-
-      specify { expect(subject.licenses_for('github.com/dimfeld/httptreemux/v5')).to match_array(['MIT']) }
-      specify { expect(subject.licenses_for('github.com/go-logfmt/logfmt')).to match_array(['MIT']) }
-      specify { expect(subject.licenses_for('github.com/google/uuid')).to match_array(['BSD-3-Clause']) }
-      specify { expect(subject.licenses_for('github.com/stretchr/testify')).to match_array(['MIT']) }
-      specify { expect(subject.licenses_for('golang.org/x/oauth2')).to match_array(['BSD-3-Clause']) }
     end
   end
 
@@ -51,8 +57,36 @@ RSpec.describe "modules" do
       runner.clone('https://gitlab.com/gitlab-org/gitaly.git')
     end
 
-    specify { expect(subject).to match_schema }
-    specify { expect(subject[:licenses]).not_to be_empty }
-    specify { expect(subject[:dependencies]).not_to be_empty }
+    specify do
+      expect(subject).to match_schema
+      expect(subject[:licenses]).not_to be_empty
+      expect(subject[:dependencies]).not_to be_empty
+    end
+  end
+
+  context "when scanning a project with vendored modules" do
+    subject { runner.scan }
+
+    before do
+      runner.mount(dir: fixture_file('go/1.14-vendored-modules'))
+    end
+
+    specify do
+      expect(subject).to match_schema
+      expect(subject.dependency_names).to match_array([
+        "github.com/davecgh/go-spew",
+        "github.com/konsorten/go-windows-terminal-sequences",
+        "github.com/pmezard/go-difflib",
+        "github.com/sirupsen/logrus",
+        "github.com/stretchr/testify",
+        "golang.org/x/sys"
+      ])
+      expect(subject.licenses_for("github.com/davecgh/go-spew")).to match_array(['unknown'])
+      expect(subject.licenses_for("github.com/konsorten/go-windows-terminal-sequences")).to match_array(['MIT'])
+      expect(subject.licenses_for("github.com/pmezard/go-difflib")).to match_array(['unknown'])
+      expect(subject.licenses_for("github.com/sirupsen/logrus")).to match_array(['MIT'])
+      expect(subject.licenses_for("github.com/stretchr/testify")).to match_array(['unknown'])
+      expect(subject.licenses_for("golang.org/x/sys")).to match_array(['BSD-3-Clause'])
+    end
   end
 end