Add go.mod and bump go-github dependency

[misha-ridge]

Due to the way Go modules mode picks up versions for dependencies that do not have go.mod file, importing go-githubapp from modules-enabled package causes Go to select ancient v17 version of go-github.

Here's the example conversion: https://github.com/tectonic-network/go-githubapp/commit/1b3705ccaef8a31d1f0ce66cd821a9d021eca24a — I ran go mod init to do so, and then manually updated go-github import URLs to point to v24.

[bluekeyes]

Thanks for reporting this - we haven't experimented much with modules yet, so I wasn't aware of these limitations. Adding the go.mod file and bumping go-github sounds fine, but I want to make sure it continues to work with our downstream projects still using dep. Do you happen know of any problems we might run into there?

[misha-ridge]

Unfortunately it seems that rewriting paths will cause non-module-aware clients to break.

There is a long discussion here: gofrs/uuid#61

AFAIU the solution is "make a v2 version of your package in a branch named v2, bump version to v2.0.x and add go.mod there", which is painful.

[bluekeyes]

Ah, that's unfortunate. Let me discuss with the team to see if we're ready to commit to using modules the next time we update our dependencies on this package or if we want to try the branch approach.

[theckman]

The only option would be to create a folder in the root of the repo for each major version. And then the code, or some sort of wrapper package, lives in there. Both dep and Modules should work with that.

Creating a branch won't work, since dep will think v2 in the import is a folder and not a branch.