Explicitly forbid workspace vendoring

cachito/workers/pkg_managers/gomod.py

@@ -382,6 +382,7 @@ def resolve_gomod(
             flags, app_source_path, worker_config.cachito_gomod_strict_vendor
         )
         if should_vendor:
+            _vet_workspace_vendoring(go, run_params)
             downloaded_modules = _vendor_deps(go, run_params, can_make_changes, git_dir_path)
         else:
             log.info("Downloading the gomod dependencies")
@@ -506,6 +507,18 @@ def go_list_deps(pattern: Literal["./...", "all"]) -> Iterator[GoPackage]:
         }
 
 
+def _vet_workspace_vendoring(go: Go, run_params: dict[str, Any]) -> None:
+    go_work_file = go(["env", "GOWORK"], run_params).rstrip()
+
+    if not go_work_file or go_work_file == "off":
+        return
+
+    vendor_dir = Path(go_work_file).parent / "vendor"
+
+    if vendor_dir.is_dir():
+        raise UnsupportedFeature("Workspace vendoring introduced in Go 1.22 is not supported")
+
+
 def _set_local_modules_versions(
     local_modules: LocalModules,
     git_dir_path: Path,

tests/test_workers/test_pkg_managers/test_gomod.py

@@ -211,7 +211,9 @@ def test_resolve_gomod(
 @mock.patch("cachito.workers.pkg_managers.gomod.GoCacheTemporaryDirectory")
 @mock.patch("subprocess.run")
 @mock.patch("cachito.workers.pkg_managers.gomod.RequestBundleDir")
+@mock.patch("cachito.workers.pkg_managers.gomod._vet_workspace_vendoring")
 def test_resolve_gomod_vendor_dependencies(
+    mock_vet_workspace_vendoring: mock.Mock,
     mock_bundle_dir: mock.Mock,
     mock_run: mock.Mock,
     mock_temp_dir: mock.Mock,
@@ -881,6 +883,43 @@ def test_vet_local_file_dep_paths_outside_repo():
         gomod._vet_local_file_dep_paths(dependencies, app_dir, git_dir)
 
 
+@pytest.mark.parametrize(
+    "go_work_env",
+    [
+        pytest.param("go.work", id="go_work_set"),
+        pytest.param("off", id="go_work_off"),
+        pytest.param("", id="go_work_empty"),
+    ],
+)
+def test_vet_workspace_vendoring(
+    go_work_env: str,
+    tmp_path: Path,
+):
+    go = mock.Mock()
+
+    # workspaces are enabled, no vendoring exists
+    if go_work_env == "go.work":
+        go.return_value = str(tmp_path / "go.work")
+
+    # workspaces are not enabled, vendoring exists
+    else:
+        go.return_value = go_work_env
+        (tmp_path / "vendor").mkdir()
+
+    gomod._vet_workspace_vendoring(go, {})
+    go.assert_called_once_with(["env", "GOWORK"], {})
+
+
+def test_vet_workspace_vendoring_fails(tmp_path: Path):
+    go = mock.Mock()
+    go.return_value = str(tmp_path / "go.work")
+    (tmp_path / "vendor").mkdir()
+
+    expect_error = "Workspace vendoring introduced in Go 1.22 is not supported"
+    with pytest.raises(UnsupportedFeature, match=expect_error):
+        gomod._vet_workspace_vendoring(go, {})
+
+
 @pytest.mark.parametrize(
     "main_module_deps, pkg_deps_pre, pkg_deps_post",
     [