Use auto-vendor to eliminate vendor content from patch 0001

.git-go-patch

@@ -1,5 +1,5 @@
 {
-  "MinimumToolVersion": "v1.0.1",
+  "MinimumToolVersion": "v1.1.0",
   "SubmoduleDir": "go",
   "PatchesDir": "patches",
   "StatusFileDir": "eng/artifacts/go-patch",

.github/workflows/patch-apply.yml

@@ -24,6 +24,10 @@ concurrency:
   group: "${{ github.ref }}-${{ github.workflow}}"
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  # Use the CI stage 0 environment.
+  MS_USE_CI_STAGE0: 1
+
 jobs:
   check_patches:
     name: Patches Apply Cleanly

.github/workflows/patch-build.yml

@@ -15,6 +15,10 @@ concurrency:
   group: "${{ github.ref }}-${{ github.workflow}}"
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  # Use the CI stage 0 environment.
+  MS_USE_CI_STAGE0: 1
+
 jobs:
   list_patches:
     name: Generate patch build matrix

eng/_util/cmd/submodule-refresh/submodule-refresh.go

@@ -108,9 +108,47 @@ func refresh(rootDir string) error {
 		config.PatchesDir = tmpDirRelative
 	}
 
-	if err := patch.Apply(config, mode); err != nil {
+	// Check if any patches have auto-vendor commands. If so, apply patches
+	// one at a time so we can run "go mod vendor" between patches.
+	_, goDir := config.FullProjectRoots()
+	autoVendorMap, err := patch.ScanAutoVendorPatches(config)
+	if err != nil {
 		return err
 	}
+
+	// Collect all auto-vendor module directories so we can run a final vendor
+	// pass after all patches are applied.
+	var allVendorDirs []string
+
+	if len(autoVendorMap) > 0 {
+		amend := mode == patch.ApplyModeCommits
+		if err := patch.ApplyIndividually(config, mode, func(patchPath string) error {
+			if dirs, ok := autoVendorMap[patchPath]; ok {
+				allVendorDirs = append(allVendorDirs, dirs...)
+				return patch.RunGoModVendor(goDir, dirs, amend)
+			}
+			return nil
+		}); err != nil {
+			return err
+		}
+	} else {
+		if err := patch.Apply(config, mode); err != nil {
+			return err
+		}
+	}
+
+	// After all patches are applied, run vendor one final time. Later patches
+	// may add new imports that weren't present when the auto-vendor patch was
+	// applied (e.g. patch 0002 imports cryptobackend/sha1 which wasn't imported
+	// at patch 0001 time). This final pass ensures vendor/ has everything.
+	// Don't amend — leave the changes in the working tree so the build can use them.
+	if len(allVendorDirs) > 0 {
+		log.Println("Running final vendor pass after all patches are applied...")
+		if err := patch.RunGoModVendor(goDir, allVendorDirs, false); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 

eng/_util/go.mod

@@ -8,7 +8,7 @@ go 1.25.0
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/microsoft/go-infra v0.0.14
+	github.com/microsoft/go-infra v0.0.15-0.20260612144113-838dee72b447
 	github.com/microsoft/go-infra/goinstallscript v1.2.0
 	golang.org/x/net v0.56.0
 )
@@ -27,7 +27,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.5 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/text v0.38.0 // indirect

eng/_util/go.sum

@@ -31,8 +31,10 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5 h1:YH424zrwLTlyHSH/GzLMJeu5zhYVZSx5RQxGKm1h96s=
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5/go.mod h1:PoGiBqKSQK1vIfQ+yVaFcGjDySHvym6FM1cNYnwzbrY=
-github.com/microsoft/go-infra v0.0.14 h1:JfMAEtUWk2sAKNyYirdph8BoKrjCKlt/vMloBy70rtg=
-github.com/microsoft/go-infra v0.0.14/go.mod h1:+NF5K79FJNpFKRPX7J9g9tZ2NFZa9dM751xWPpF3IgY=
+github.com/microsoft/go-infra v0.0.15-0.20260612140757-70acb19cde0a h1:jS173C4EA1H8R8Sxu0fOUM8bDKC1n8mFWPVz++Ib0KQ=
+github.com/microsoft/go-infra v0.0.15-0.20260612140757-70acb19cde0a/go.mod h1:fbkBK1WeHaeKy5flQsbFod3IdNsTeMQGryHAkdq37Ks=
+github.com/microsoft/go-infra v0.0.15-0.20260612144113-838dee72b447 h1:42fGrc2dWT9wcPwXONgP6qPA0t0zNeOfC3sBZhmTJEI=
+github.com/microsoft/go-infra v0.0.15-0.20260612144113-838dee72b447/go.mod h1:fbkBK1WeHaeKy5flQsbFod3IdNsTeMQGryHAkdq37Ks=
 github.com/microsoft/go-infra/goinstallscript v1.2.0 h1:ArYnZHsmv0jnpeDZdFACBUxSmhmYl+Vof8sfk19aYZI=
 github.com/microsoft/go-infra/goinstallscript v1.2.0/go.mod h1:SFsdKAEHdmGsGoh8FkksVaxoQ3rnnJ/TBqN09Ml/0Cw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
@@ -49,8 +51,8 @@ github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
-go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.5 h1:JVliQq9EGOYaTgMi+k8BhUJyqcGk4ZqeuiN1Cirba9c=
+go.yaml.in/yaml/v4 v4.0.0-rc.5/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
@@ -59,8 +61,8 @@ golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
+golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

eng/_util/internal/patchcheck/vendoronly.go

@@ -6,8 +6,11 @@ package patchcheck
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/microsoft/go-infra/patch"
 )
 
 // vendorPatchGlob matches the vendor patch filename.
@@ -28,6 +31,13 @@ var vendorOnlyPaths = []string{
 	"src/cmd/internal/telemetry/counter/deps_ignore.go",
 }
 
+// autoVendorOmittedPaths are vendor-only paths that are expected to be absent
+// from the patch when it uses auto-vendor (they are generated at apply time).
+var autoVendorOmittedPaths = []string{
+	"src/vendor/",
+	"src/cmd/vendor/",
+}
+
 // vendorSharedPaths must appear in the vendor patch, but may also appear in
 // non-vendor patches.
 var vendorSharedPaths = []string{
@@ -41,6 +51,20 @@ func appendVendorOnlyIssues(issues []*PatchIssue, patchFile string, mods []patch
 		return nil, err
 	}
 
+	// Detect whether the vendor patch uses auto-vendor. If it does, vendor
+	// directory diffs (src/vendor/, src/cmd/vendor/) are generated at apply
+	// time and won't appear in the patch file.
+	usesAutoVendor := false
+	if isVendorPatch {
+		content, err := os.ReadFile(patchFile)
+		if err != nil {
+			return nil, fmt.Errorf("reading patch file %s: %w", patchFile, err)
+		}
+		if strings.Contains(string(content), patch.AutoVendorPrefix) {
+			usesAutoVendor = true
+		}
+	}
+
 	for _, mod := range mods {
 		vo := isVendorOnlyPath(mod.path)
 		vs := isVendorSharedPath(mod.path)
@@ -60,6 +84,11 @@ func appendVendorOnlyIssues(issues []*PatchIssue, patchFile string, mods []patch
 
 	if isVendorPatch {
 		for _, required := range append(vendorOnlyPaths, vendorSharedPaths...) {
+			// When using auto-vendor, vendor directory diffs are generated
+			// at apply time and won't be in the patch file.
+			if usesAutoVendor && matchPathList(autoVendorOmittedPaths, required) {
+				continue
+			}
 			found := false
 			for _, mod := range mods {
 				if matchPathList([]string{required}, mod.path) {

eng/pipeline/rolling-internal-validation-pipeline-unofficial.yml

@@ -16,7 +16,8 @@ parameters:
     type: boolean
     default: true
   - name: disableTSA
-    displayName: '[Debug input] Disable TSA reporting. Use to try modifications in dev branches.'
+    displayName: '[Debug input] Disable TSA reporting. Use to try modifications in
+      dev branches.'
     type: boolean
     default: true
 trigger: none

eng/pipeline/rolling-internal-validation-pipeline.yml

@@ -16,7 +16,8 @@ parameters:
     type: boolean
     default: false
   - name: disableTSA
-    displayName: '[Debug input] Disable TSA reporting. Use to try modifications in dev branches.'
+    displayName: '[Debug input] Disable TSA reporting. Use to try modifications in
+      dev branches.'
     type: boolean
     default: false
 trigger: none