fix(gomod): pseudo-version digest updates produce no change when module

is absent from go proxy

Author: Maydaer

lib/modules/manager/gomod/update.spec.ts

@@ -400,6 +400,33 @@ describe('modules/manager/gomod/update', () => {
       expect(res).not.toContain('knative.dev/pkg 4a022ed9999a');
     });
 
+    it('falls back to bare hash when newValue equals currentValue', () => {
+      const fileContent = codeBlock`
+        module example.com/test
+        require (
+          example.private.com/org/module v0.0.0-20250312035536-b7bbf4be5dbd
+        )
+      `;
+      const upgrade = {
+        depName: 'example.private.com/org/module',
+        managerData: { lineNumber: 2, multiLine: true },
+        updateType: 'digest' as const,
+        currentValue: 'v0.0.0-20250312035536-b7bbf4be5dbd',
+        currentDigest: 'b7bbf4be5dbd',
+        newValue: 'v0.0.0-20250312035536-b7bbf4be5dbd',
+        newDigest: '4a022ed9999a',
+        depType: 'require',
+      };
+      const res = updateDependency({
+        fileContent,
+        packageFile: 'go.mod',
+        upgrade,
+      });
+      // Should fall back to bare hash since newValue === currentValue
+      expect(res).toContain('example.private.com/org/module 4a022ed9999a');
+      expect(res).not.toContain('b7bbf4be5dbd');
+    });
+
     it('handles multiline mismatch', () => {
       const upgrade = {
         depName: 'github.com/fatih/color',

lib/modules/manager/gomod/update.ts

@@ -83,7 +83,13 @@ export function updateDependency({
       // Since the 2024 goproxy datasource changes, newValue and newDigest are
       // both extracted from the same proxy version string and always reference
       // the same commit, so newValue can be written directly for pseudo-versions.
-      if (upgrade.newValue?.startsWith('v0.0.0-')) {
+      // However, for private modules (GONOPROXY / direct datasource), the proxy
+      // has no data and newValue may equal currentValue. In that case, fall
+      // through to the bare hash path so that gomodTidy can resolve it.
+      if (
+        upgrade.newValue?.startsWith('v0.0.0-') &&
+        upgrade.newValue !== upgrade.currentValue
+      ) {
         logger.debug(
           { depName: currentName, lineToChange, newValue: upgrade.newValue },
           'gomod: updating pseudo-version digest',
@@ -94,10 +100,10 @@ export function updateDependency({
           `$<depPart>$<divider>${upgrade.newValue}`,
         );
       } else {
-        // Defensive fallback for non-pseudo-version digest updates.
-        // Unreachable for gomod in practice: currentDigest is only extracted
-        // for pseudo-versions, and the gomod override in lookup/index.ts that
-        // sets updateType='digest' requires newValue to start with 'v0.0.0-'.
+        // Fallback for private modules where the proxy could not resolve a new
+        // pseudo-version, or non-pseudo-version digest updates.
+        // Writes the bare hash so that postUpdateOptions like gomodTidy can
+        // normalize it into a valid pseudo-version via `go get`.
         const newDigestRightSized = upgrade.newDigest!.substring(
           0,
           upgrade.currentDigest!.length,