x/vuln: govulncheck v1.0.2 doesn't support workspaces anymore

[tinmrn]

in a repo with a go.work file:

$ go install golang.org/x/vuln/cmd/govulncheck@v1.0.2 && govulncheck ./...
govulncheck: loading modules: /usr/local/go/bin/go list -m -json -mod=mod all: exit status 1
go: -mod may only be set to readonly when in workspace mode, but it is set to "mod"
        Remove the -mod flag to use the default readonly value,
        or set GOWORK=off to disable workspace mode.

might be since this change https://go.googlesource.com/vuln/+/61b4508dba3bfb2ddc378c5f84bedfa3a544b0b7%5E%21/internal/vulncheck/packages.go

v1.0.1 does not have this problem.

might be related to #65124

[zpavlinovic]

Yes, this seems related. We are working on it.

[ldemailly]

I've put a repro in my duplicate #65155 if it helps - any workaround meanwhile? [well I guess I can pin my action to 1.0.1 instead of latest]

[gopherbot]

Change https://go.dev/cl/556775 mentions this issue: internal/vulncheck: remove -mod=mod flag from LoadModules

[maceonthompson]

We just merged a hotfix for folks with a go.work file - would you both be able to recreate the same steps with go install golang.org/x/vuln/cmd/govulncheck@master instead of @latest?

A proper/cleaner fix which will also address those using vendor directories will be merged and a new version with the fixes will be tagged and released by Monday.