Go "missing go.sum entry; to add it run go mod download" - Fix in CI

By Kaveh Alemi·Latchkey

A readonly build needs a module whose checksum is not recorded in go.sum. Go will not silently add it, so it stops and tells you to run go mod download.

What this error means

A build fails with missing go.sum entry for module X; to add it, run: go mod download X. It almost always means go.sum was not committed after a dependency change, or a partial tidy ran.

go: github.com/foo/bar@v1.3.0: missing go.sum entry; to add it:
	go mod download github.com/foo/bar

Common causes

go.sum not refreshed after a dependency change

A bump or new import never had its checksum written to go.sum, so a readonly build cannot verify it.

Only go.mod was committed

go.mod was staged but go.sum was left out, leaving the checksum file incomplete.

How to fix it

Download and tidy, then commit go.sum

1. Run go mod download (or go mod tidy) to record the missing checksums.
2. Commit go.mod and go.sum together.

go mod download all
go mod tidy
git add go.mod go.sum

Guard go.sum completeness in CI

1. Run go mod tidy in the pipeline.
2. Fail if go.mod or go.sum changes, flagging an uncommitted entry.

go mod tidy
git diff --exit-code go.mod go.sum

How to prevent it

• Run go mod tidy after every dependency change.
• Always stage go.mod and go.sum together.
• Add a git diff --exit-code go.mod go.sum guard to CI.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation