Commit the go.sum that go mod tidy produces

[richhaase]

go.sum was assembled by go get during the port and never tidied afterwards, so it is missing the two github.com/google/go-cmp hashes that go mod tidy adds. go-cmp is a test dependency of goimports, which the repo pulls in via the tool directive in go.mod:

$ go mod why -m github.com/google/go-cmp
golang.org/x/tools/cmd/goimports
golang.org/x/tools/internal/imports
golang.org/x/tools/internal/imports.test
github.com/google/go-cmp/cmp

CI never caught it because it runs go mod verify and go mod download, both of which are satisfied by the existing file. Two consequences:

• anyone running go mod tidy gets an unexplained two-line diff
• .goreleaser.yaml runs go mod tidy as a before-hook, so cutting a release would have mutated go.sum mid-build

After this the tree is idempotent under its own tooling — a second go mod tidy is a no-op, go mod verify reports all modules verified, and make check passes.

My oversight from the port; found while dry-running make release-snapshot to check the release path before any tag is cut.

🤖 Generated with Claude Code

[richhaase]

LGTM ✅

3 of 3 reviewers found no issues.

Reviewer comments

• Reviewer 1: The patch only adds checksums produced by go mod tidy, and go mod tidy -diff reports no remaining changes. It does not alter runtime behavior or break existing code.
  Categorized as informational during summarization
• Reviewer 2: The patch only adds checksums produced by go mod tidy. Running go mod tidy -diff produces no further changes, and the additions do not alter runtime behavior.
  Categorized as informational during summarization
• Reviewer 3: The patch only adds checksums produced by go mod tidy. go mod verify succeeds, and go mod tidy -diff reports no remaining differences.
  Categorized as informational during summarization

Posted by acr 0.20.4