Is it possible to automatically load transitive dependencies with Gazelle?

Question

I'd like to use Gazelle to manage my Go dependencies (and their dependencies) in Bazel. Running bazel run //:gazelle update-repos firebase.google.com/go adds a properly configured go_repository to my WORKSPACE file:

go_repository(
    name = "com_google_firebase_go",
    importpath = "firebase.google.com/go",
    sum = "h1:3TdYC3DDi6aHn20qoRkxwGqNgdjtblwVAyRLQwGn/+4=",
    version = "v3.13.0+incompatible",
)

However, this does not work out of the box. Running bazel build @com_google_firebase_go//:go_default_library returns an error:

ERROR: /private/var/tmp/_bazel_spencerconnaughton/9b09d78e8f2190e9af61aa37bcab571e/external/com_google_firebase_go/BUILD.bazel:3:11: no such package '@org_golang_google_api//option': The repository '@org_golang_google_api' could not be resolved and referenced by '@com_google_firebase_go//:go'
ERROR: Analysis of target '@com_google_firebase_go//:go_default_library' failed; build aborted: Analysis failed
INFO: Elapsed time: 0.596s
INFO: 0 processes.
FAILED: Build did NOT complete successfully (23 packages loaded, 133 targets configured)

Is there a way to tell gazelle to load the @org_golang_google_api transitive dependency and others without needing to run update-repos for each one?

Answer 1

I have been struggling with this as well, but it seems that you can simply solve it by using go mod :)

If you use the go mod and go get commands to generate go.mod files, the transative dependencies are included automatically. You can then use this go.mod file in your bazel-gazelle command ;)

let's say your project is called github.com/somesampleproject:

go mod init github.com/somesampleproject

Then, use go get to add your dependency to the go.mod file:

go get firebase.google.com/go

go mod actually handles the transitive dependencies as well, as described in the documentation here. So your go.mod file should contain all of your required dependencies now :)

I quickly tried this out with gazelle in one of our projects (as described in the gazelle documentation)

bazel run //:gazelle -- update-repos -from_file=\<insert-subfolder-here>/go.mod

now our WORKSPACE file includes the firebase dependency, but also the dependencies that firebase has itself.

For bonus points you could use tools to validate your go.mod file to make sure you have no dependencies with known security bugs, a quick google search returned snyk, nancy and built-in support in ide's such as vs code apparently ;)