[retr0h]

Found while merging the otel 1.47 Dependabot PRs. go-mod-check has never been able to fail in this repository.

The CI step cancels the check

      - name: Deps
        run: |
          just go-deps
          just go-mod          # <- downloads AND tidies
          just react-deps
      - name: Test
        run: just test         # <- go-mod-check runs in here

just go-mod is "download + tidy", and it runs before just test. By the time go-mod-check executes there is nothing left to find. Every green run has meant "CI tidied this for us", not "the modules are tidy" — and since the tidy is never committed, the untidy state merges to main regardless.

osapi is the only repository in the organization that does this:

$ for r in osapi gohai nats-client nats-server osapi-orchestrator; do
    printf "%-20s " "$r"
    gh api repos/osapi-io/$r/contents/.github/workflows/go.yml -q .content \
      | base64 -d | grep -c "just go-mod$"
  done
osapi                1
gohai                0
nats-client          0
nats-server          0
osapi-orchestrator   0

That difference is exactly why the identical otel 1.47 bump failed in osapi-io/nats-client#172 and passed on all four PRs here.

What slipped through

#598 merged green and left examples/sdk/client untidy on main. Dependabot bumps the root go.mod and stops; that example module has its own and still required otel 1.46 as an indirect.

With the step removed the check names it immediately, which is how I found it:

untidy: examples/sdk/client
run 'just go-mod' and commit the result

Tidied here. otel 1.47 also introduces otel/log, which enters that module's indirect block.

Why removing it is safe

just go-deps already pulls what the test recipes need, which is how the other four repositories work. go-mod-check itself runs go mod tidy -diff, which needs a populated module cache, and that works in all four of them without just go-mod.

just test passes, coverage 100%.

Dependabot state, for the record

PR	Outcome
osapi-io/nats-client#172 (otel)	Needed the same example-module tidy, five modules. Pushed to the branch, merged.
#598 (otel)	Merged.
#600 (otel/metric), #601 (otel/trace)	Dependabot closed them itself after #598 landed: "up-to-date now, so this is no longer needed."
#599 (otlptrace)	Went DIRTY on rebase; @dependabot recreate requested.

main is partially bumped: otel, metric and trace at 1.47 while otlptrace, otlptracegrpc, sdk, sdk/metric and stdouttrace are still 1.46. That is #599's job and blocks nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FuKUsHFG1EqZXamffh9M2c

[retr0h]

Swept every workflow in the organization to confirm osapi is the only one, since the same mistake elsewhere would be invisible the same way.

61 workflow files across all 8 non-archived repositories (.github, gohai, nats-client, nats-server, osapi, osapi-justfiles, osapi-orchestrator, specs), checked for any recipe that mutates the tree before a check runs:

$ grep -nE "just (go-fmt|md-fmt|just-fmt|docusaurus-fmt|go-mod|generate)( |$)" * | grep -v -- "-check"
osapi__go.yml:49:          just go-mod

One hit, the line this PR removes. Every other repository runs only -check variants plus non-mutating setup:

Recipe in CI	Mutates?
just deps → just go-deps → _go-mod-download → go mod download	no
just go-deps, just react-deps	no
just fetch, just version, just linux-tune	no
just md-fmt-check, just just-fmt-check, just docusaurus-fmt-check	no, checks
just test, just go-unit-int, just react-build, just docusaurus-build	no

So nothing else needs changing.

The shared justfile already said this

go-mod-check in osapi-justfiles was written for exactly this hazard, and says so:

# go-mod runs inside a throwaway CI checkout, so tidying there fixes
# nothing and the committed drift survives every green build. This
# reports it instead of repairing it.

The check was built to report rather than repair. osapi's workflow put the repairer in front of it, which is the one way to defeat that design. CI should run against what is committed, and for the four other repositories it does.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main     #603   +/-   ##
=======================================
  Coverage   99.95%   99.95%           
=======================================
  Files         501      501           
  Lines       24099    24099           
=======================================
  Hits        24089    24089           
  Misses         10       10           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f0f727f...3155c95. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.