add support for go workspaces

[aryan9600]

Add a go.work file listing all modules in this monorepo and remove local replace directives from all go.mod files

Fixes #400

Signed-off-by: Sanskar Jaiswal jaiswalsanskar078@gmail.com

[darkowlzz]

Thanks for adding workspaces. It helps the IDEs and gopls work nicely with this repository with so many modules. Would be good to have it in all the controllers and their API packages.

While research about it, I came across the issue of go build using the module dependency from workspace instead of local go.mod file, which may have unintended results. So the workspaces is turned off in the release environment, for example https://github.com/kubernetes-sigs/kustomize/blob/kustomize/v4.5.7/releasing/run-goreleaser.sh#L124 . I think we need something similar.
But at the same time, we don't build and publish binaries from this repository. So maybe not fully applicable.

[darkowlzz]

Other than the gogit version set in git e2e test, this looks good to me.
But please have one/few more reviews on it before merging because it affects the whole repository.

[stefanprodan]

LGTM

We need to enable workspaces on all controllers, this way the CVE scanners should no longer be confused by which API version we're using. Right now scanners can't determine the version of a locally replaced package and they report old CVEs, but with workspaces the API version gets set in go.sum. The main difference to the release procedure, is that tagging the API is a must before opening the controller release PR.

[hiddeco]

Think the problem with the go.work file in the root of this repository is that now all modules are assumed to have a relationship. This isn't necessarily true, and seems to break the isolation of packages which didn't have any replacement directives in their go.mod files before.

[stefanprodan]

I've done some testing with this, and having a single workspace makes all packages share the same dep , which is bad... also this PR contains un-synced deps, @aryan9600 have you've run go work sync?

[hiddeco]

Closing this as it does not seem a viable solution for now (and it has been stale for a long time).