Add gomod-vendor-check flag

Needs to be added to downstream for both the quay-operator and quay-bridge-operator.

—
As part of the efforts to unify and simplify Cachito configuration, for avoiding ambiguous situations during processing of Go dependencies, we are going to introduce the following change:

For a repository that has go mod dependencies, if a vendor directory exists, Cachito will not process the request and set a fail state for it, unless a corresponding flag is set (gomod-vendor or gomod-vendor-check) [1].

To prevent the situation we suggest to do one of the following:

Stop using vendored dependencies; or

Declare the gomod-vendor-check flag in container.yaml, e.g.:

—

image_build_method: imagebuilder

remote_source:

repo: https://git.example.com/team/repo.git

ref: 4967a2a43417b2ebe5a01ae7fc95cb0b6c190142

pkg_managers:

• gomod

flags:

• gomod-vendor-check

This change will be introduced on Jan 21, 2022, so please make sure that your repositories meet the new requirements until then.

For more information about gomod vendoring in Cachito, please read the Container Build documentation [2]. You can also follow the related tickets in Jira[3].

Links:

1. https://github.com/release-engineering/cachito/#flags

2. https://source.redhat.com/groups/public/container-build-system/container_build_system_wiki/containers_from_source_multistage_builds_in_osbs#jive_content_id_Gomod_Vendoring
3. https://issues.redhat.com/browse/CLOUDBLD-1710