Skip to content

go.mod/go.sum cleanup, docsy → v0.6.0, pin Netlify Hugo#5021

Open
NickPPC wants to merge 3 commits intomainfrom
worktree-dependency-upgrade
Open

go.mod/go.sum cleanup, docsy → v0.6.0, pin Netlify Hugo#5021
NickPPC wants to merge 3 commits intomainfrom
worktree-dependency-upgrade

Conversation

@NickPPC
Copy link
Copy Markdown
Member

@NickPPC NickPPC commented Apr 26, 2026

Summary

The go.sum file contained incorrect hashes for github.com/google/docsy (both v0.2.0 and v0.5.0) that did not match the canonical hashes published by sum.golang.org, causing checksum verification failures on go mod download. This PR regenerates go.sum with verified hashes, tidies go.mod, bumps docsy from v0.5.0 to v0.6.0 so go mod verify passes, and pins Netlify's Hugo version to match CI so deploys reproduce the build environment that GitHub Actions already validates against.

This is phase 1 of a planned three-phase dependency cleanup. Phase 2 (Hugo bump) and phase 3 (larger docsy upgrade toward v0.14.x) will follow in separate PRs.

Why bump docsy to v0.6.0?

docsy v0.5.0's go.mod requires dependencies@v0.5.0-0.20220905171817-ae8b8117ed16 — a malformed pseudo-version (a -0. prefix on the same base version implies a negative patch number). Modern Go toolchains reject it, so go mod verify fails on the resolved module graph. v0.6.0 uses a properly-tagged dependencies@v0.6.0 require, which restores verification. v0.6.0 is the smallest possible step that fixes this — Bootstrap stays on 4.x (v5 first arrives in docsy v0.7.0), and the theme templates we render with are unchanged.

Why pin HUGO_VERSION on Netlify?

netlify.toml did not pin a Hugo version, so Netlify used whatever default its build image shipped with. Recent Netlify builds drifted onto a Hugo version that errors hard on .Site.Author.email access (a long-deprecated field still referenced by docsy's list.rss.xml). GitHub Actions already pins hugo-version: "0.152.2" (the version recorded as "successfully tested" in config.toml's module.hugoVersion.min), so this commit pins Netlify to the same value. Eliminates drift between CI and Netlify and unblocks the deploy preview. Will be revisited when Hugo itself is bumped in phase 2.

Changes

  • go.sum: Replaced all incorrect hashes (h1: + /go.mod for both docsy v0.2.0 and docsy v0.5.0 did not match sum.golang.org); regenerated for the new v0.6.0 graph. Now contains full h1: + /go.mod hashes for all four modules (docsy, docsy/dependencies, Font-Awesome, bootstrap), each cross-verified against sum.golang.org.
  • go.mod: Bumped docsy and docsy/dependencies from v0.5.0v0.6.0. Removed stale docsy v0.2.0 require, dropped // indirect markers (both modules are direct Hugo imports per config.toml), and bumped the go directive from 1.121.23.
  • netlify.toml: Added [build.environment] HUGO_VERSION = "0.152.2" to match CI's pinned Hugo version.
  • Transitive bumps via docsy v0.6.0: Bootstrap v4.6.1v4.6.2; Font-Awesome pin advanced to a 2022-08 commit.

Testing

  • go mod verifyall modules verified
  • go mod download -json confirms Sum/GoModSum match for all four modules in the graph.
  • All hashes cross-verified against https://sum.golang.org/lookup/....
  • hugo mod tidy is a no-op against the new go.mod/go.sum (the module graph is canonical).
  • GitHub Actions checks (htmltest, prettier, vale, codespell, etc.) — all green on the docsy bump alone.
  • Local Hugo v0.160.1 reproduces the .Site.Author.email error that the Netlify pin works around — confirming the pin is the right fix for the deploy failure rather than a docsy regression.
  • Verified the deploy previewhttps://deploy-preview-5021--viam-docs.netlify.app/ looks normal

Tickets

None.

Claude Code Prompts Used

  • "Hi Claude, this repo seems to have an issue with its go.sum file. We may also want to consider upgrading the docsy dependency or even the hugo dependency. Can you take a look and provide a recommendation?"
  • "Let's proceed with phase 1"
  • "Let's create a draft PR"
  • "What upgrade do we need to make to get go mod verify passing?"
  • "Let's make the change to v0.6.0 in this PR"
  • "how do I install hugo?"
  • "I have installed hugo. Can you check if things seem fine"
  • "let's do option 1"

🤖 Generated with Claude Code

@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 26, 2026

Deploy Preview for viam-docs ready!

Name Link
🔨 Latest commit 62bd8a5
🔍 Latest deploy log https://app.netlify.com/projects/viam-docs/deploys/69ee3a1ea87e33000836d9b5
😎 Deploy Preview https://deploy-preview-5021--viam-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 36 (🔴 down 10 from production)
Accessibility: 99 (no change from production)
Best Practices: 83 (🔴 down 9 from production)
SEO: 92 (🟢 up 3 from production)
PWA: 60 (no change from production)
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

@viambot viambot added the safe to build This pull request is marked safe to build from a trusted zone label Apr 26, 2026
@NickPPC NickPPC changed the title Fix corrupted go.sum hashes and clean up go.mod Fix corrupted go.sum hashes and bump docsy to v0.6.0 Apr 26, 2026
@NickPPC NickPPC changed the title Fix corrupted go.sum hashes and bump docsy to v0.6.0 go.mod/go.sum cleanup, docsy → v0.6.0, pin Netlify Hugo Apr 26, 2026
NickPPC and others added 3 commits April 26, 2026 12:15
The recorded hashes for docsy v0.2.0 and v0.5.0 in go.sum did not match
the canonical hashes published by sum.golang.org, causing checksum
verification failures. Regenerated go.sum with verified hashes for the
versions actually resolved by the module graph.

Also cleaned up go.mod: dropped the stale v0.2.0 require (MVS already
resolved to v0.5.0 transitively), removed `// indirect` markers since
both modules are direct Hugo imports per config.toml, and bumped the
go directive from 1.12 to 1.23.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
docsy v0.5.0's go.mod requires `dependencies@v0.5.0-0.<timestamp>-<hash>`,
a malformed pseudo-version (`-0.` prefix on the same base version implies
a negative patch number). Modern Go toolchains reject it, so `go mod verify`
fails on the resolved graph. v0.6.0 uses a properly-tagged `dependencies@v0.6.0`
require, so verification passes.

Also pulls Bootstrap from v4.6.1 to v4.6.2 (stays on 4.x — Bootstrap 5
arrives in docsy v0.7.0) and bumps Font-Awesome.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Netlify's default Hugo image had drifted past the version that tolerates
docsy's `list.rss.xml` referencing `.Site.Author.email` — a deprecated
field that newer Hugo treats as a hard error. GitHub Actions builds
already pin `hugo-version: 0.152.2` (the version recorded as
successfully tested in `config.toml`'s module.hugoVersion.min); pin
Netlify to the same value so previews and the production deploy use
the same Hugo as CI.

This will be revisited when Hugo is bumped in phase 2 of the
dependency cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@NickPPC NickPPC force-pushed the worktree-dependency-upgrade branch from fdb7c35 to 62bd8a5 Compare April 26, 2026 16:15
@NickPPC NickPPC marked this pull request as ready for review April 26, 2026 16:27
@NickPPC NickPPC requested a review from ale7714 April 26, 2026 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

safe to build This pull request is marked safe to build from a trusted zone

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants