title: Getting all dependencies of a Go project
body: <p>For my project I am trying to get all the dependencies and sub dependencies of my project. I need to specific version of each of these dependencies. Not only do I need the dependencies of my project, but the dependencies of the dependencies and so on until the root.</p>
  
  <p>For my project, <code>go list -m all</code> works for everything except indirect dependencies that have not opted into using go.mod files. Right now my workflow is taking an initial batch of repositories, downloading them from git then using “GO111MODULE=on go build ./…”. and “GO111MODULE=on go list -m -json all” to get the list of dependencies. I do not check for go.mod as all of the repositories I am scanning are using go.mod files. </p>
  
  <p>For the list of dependencies that come out of this initial list I have some questions, for files without go.mod files, I used this as a reference: “<a href="https://blog.golang.org/using-go-modules" rel="nofollow noreferrer">https://blog.golang.org/using-go-modules</a>”</p>
  
  <p>-Path = Received from <code>go list -m all</code>, it can be GitHub, gopkg, or whatever is used to dl the go package.</p>
  
  <p>Without go.mod</p>
  
  <pre><code>-“GO111MODULE=on go mod init &lt;PATH from parent go.mod&gt;”
  
  -“GO111MODULE=on go build ./…”
  
  -“GO111MODULE=on go mod tidy”
  
  -“GO111MODULE=on go list -m -json all”
  
  -From there I get a list of the dependencies of this module. 
  </code></pre>
  
  <p>With go.mod </p>
  
  <pre><code>-“GO111MODULE=on go build ./…”
  
  -“GO111MODULE=on go mod tidy”
  
  -“GO111MODULE=on go list -m -json all”
  </code></pre>
  
  <p>Should I be running <code>go build</code> on each dependency that has a go.mod file? For ones without a go.mod file, I understand this should be done, as how else will we populate the go.mod file with the dependencies. But for files with a go.mod file, will I be pulling extra stuff that is not necessarily being used by my project with go build, like test files and other files that might not be used when I am simply importing that project? I understand that its better to get more unused dependencies rather than missing some, but it is getting a bit overwhelming with how massive the amount of dependencies is. </p>