# Go Modules- A Guide for monorepos (Part 2)

[Grab](https://yomu.fyi/company/grab) · Michael Cartmell · Aug 12, 2020

**Type:** Problem & solution

## Summary

Managing dependencies in a multi-module monorepo created developer friction at Grab due to unexpected changes from previous vendoring attempts and accidental imports. Because Go modules were not yet enabled directly for builds, the team implemented a continuous integration check that executes go mod vendor and rejects merge requests if any diffs exist in go.mod or the vendor directory. Adopting this CI check required configuring SSH deploy keys for private repositories, adding retry logic for network-related false positives, and standardizing on a single Go version to prevent checksum discrepancies. To streamline ongoing maintenance across hundreds of dependencies, the team developed an automated tool named AutoVend Bot. The bot runs go list -m -u all to detect updates and opens a scheduled batch of merge requests each day for human review.

## Context

Developers in a multi-module monorepo frequently encountered unexpected changes, accidental imports, and broken states in go.mod and vendor directories during manual dependency updates.

## Approach / What changed

Grab added a CI validation step running go mod vendor to reject merge requests with unexpected dependency diffs, and built an automated bot using go list -m -u all to generate scheduled dependency upgrade merge requests.

## Takeaways

- Running go mod vendor during continuous integration checks and rejecting resulting diffs ensures go.mod and vendor directory integrity before merging.
- Executing go mod vendor across different Go versions, such as Go 1.12 versus later releases, can produce inconsistent results such as differing checksums.
- The command go list -m -u all can be paired with JSON output formatting to power automated dependency update bots that generate isolated merge requests.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Developer Experience](https://yomu.fyi/topic/developer-experience), [Go](https://yomu.fyi/topic/go)

[Read original post](https://engineering.grab.com/go-module-a-guide-for-monorepos-part-2)