All Bazel commands fail when changing a Go dependency when using Bzlmod extension

[chenxiao0228]

What version of gazelle are you using?

0.38.0

What version of rules_go are you using?

0.48.0

What version of Bazel are you using?

7.2.1

Does this issue reproduce with the latest releases of all the above?

Yes

What operating system and processor architecture are you using?

MacOS, Arm64

What did you do?

Checkout https://github.com/chenxiao0228/cobra/tree/bazel_demo

change "github.com/cpuguy83/go-md2man/v2 v2.0.4" -> "github.com/cpuguy83/go-md2man/v2 v2.0.3" in "go.mod"

run "bazel run gazelle", or any Bazel command "bazel build cobra", "bazel mod tidy"

What did you expect to see?

Be able to run "bazel run @rules_go//go -- mod tidy" to fetch the new version and add its hash in "go.sum"
Or even better
Be able to run "bazel mod tidy" so everything is up to date

What did you see instead?

All Bazel commands fail with "Error in fail: No sum for github.com/cpuguy83/go-md2man/v2@2.0.3 from parent-label-todo found. You may need to run: bazel run @rules_go//go -- mod tidy"

Even though Gazelle suggests "You may need to run: bazel run @rules_go//go -- mod tidy", the command fails with the same err msg.

[fmeum]

This is tricky: We either need to avoid any dependency on the go_deps extension or we have to make missing sums non-fatal for the extension, with failures deferred to repo fetch time. I actually prefer the latter as it reduces the potential to introduce truly global failures.

@tyler-french @linzhp What do you think?

[chenxiao0228]

@fmeum thanks for looking at this.

I feel it would be great if we can defer the fatal error so folks can still run go mod tidy through Bazel - as the err msg message suggests.

Furthermore if we can wire up "bazel mod tidy" as a one stop shop to maintain Go dependencies in a big repo that would be awesome.

[Buzz-Lightyear]

@fmeum I'm running into this issue too, I made the missing sum(s) non fatal and it worked as expected:

Dependency Bump:

diff --git a/<module>/go.mod b/<module>/go.mod
...
-      <dep> v1.1.6
+      <dep> v1.1.8

bazel mod tidy output:

DEBUG: /private/var/tmp/.../external/gazelle~/internal/bzlmod/go_deps.bzl:587:40: For Go module "<dep>", the root module requires module version v1.1.6, but got v1.1.8 in the resolved dependency graph.
DEBUG: /private/var/tmp/.../external/gazelle~/internal/bzlmod/go_deps.bzl:699:18: No sum for <dep>@1.1.8 found, run bazel run @rules_go//go -- mod tidy to generate it