validate/vendor: always tidy
**- What I did**
Prevent #44453 or similar by always running `go mod tidy` when checking vendoring.

**- How I did it**
Allow running individual steps in `hack/vendor.sh` while still using it as the exclusive wrapper for `go mod` by introducing 'subcommands'; the default behavior is identical to the previous (which is now aliased as the `all` subcommand).

Make `hack/validate/vendor` take advantage of these split steps, and refactor it to be more robust against whitespace/follow bash best practices.

**- How to verify it**
Manually; revert #44453 locally to test tidy detection, and commit a modification to a vendored file to test re-vendor detection.

**- Description for the changelog**
N/A

**- A picture of a cute animal (not mandatory but encouraged)**
![](https://cdn.discordapp.com/attachments/704333319697072231/1041724104077750373/78191E84-9FF7-4BE8-9F2D-D94EEEAA48FA.jpg)


hack/validate/vendor
#!/usr/bin/env bash

SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPTDIR}/.validate"

validate_vendor_diff() {
	IFS=$'\n'
	check_files=('vendor.sum' 'vendor.mod' 'vendor/')
	# shellcheck disable=SC2207
	changed_files=($(validate_diff --diff-filter=ACMR --name-only -- "${check_files[@]}" || true))
	unset IFS

	if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ "${#changed_files[@]}" -gt 0 ]; then
		# recreate vendor/
		./hack/vendor.sh
		# check if any files have changed
		diffs="$(git status --porcelain -- "${check_files[@]}" 2> /dev/null)"
		mfiles="$(echo "$diffs" | awk '/^ M / {print $2}')"
		if [ "$diffs" ]; then
			{
				echo 'The result of go mod vendor differs'
				echo
				echo "$diffs"
				echo
				echo 'Please vendor your package with hack/vendor.sh.'
				echo
				if [ -n "$mfiles" ]; then
					git diff -- "$mfiles"
				fi
			} >&2
			false
		else
			echo 'Congratulations! All vendoring changes are done the right way.'
		fi
	else
		echo 'No vendor changes in diff.'
	fi
}

# 1. make sure all the vendored packages are used
# 2. make sure all the packages contain license information (just warning, because it can cause false-positive)
validate_vendor_used() {
	for f in $(mawk '$1 = "#" { print $2 }' 'vendor/modules.txt'); do
		if [ -d "vendor/$f" ]; then
			if ! echo "vendor/$f"/* | grep -qiEc '/(LICENSE|COPYING)'; then
				echo "WARNING: could not find copyright information for $f"
			fi
		fi
	done
}

validate_vendor_diff
validate_vendor_used

#!/usr/bin/env bash

set -e

SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPTDIR}/.validate"

tidy_files=('vendor.mod' 'vendor.sum')
vendor_files=("${tidy_files[@]}" 'vendor/')

validate_vendor_tidy() {
	# run mod tidy
	./hack/vendor.sh tidy
	# check if any files have changed
	git diff --quiet HEAD -- "${tidy_files[@]}"
}

validate_vendor_diff() {
	mapfile -t changed_files < <(validate_diff --diff-filter=ACMR --name-only -- "${vendor_files[@]}")

	if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ "${#changed_files[@]}" -gt 0 ]; then
		# recreate vendor/
		./hack/vendor.sh vendor
		# check if any files have changed
		git diff --quiet HEAD -- "${vendor_files[@]}"
	else
		echo >&2 'INFO: no vendor changes in diff; skipping vendor check.'
	fi
}

validate_vendor_license() {
	while IFS= read -r module; do
		test -d "vendor/$module" || continue
		if ! compgen -G "vendor/$module/*" | grep -qEi '/(LICENSE|COPYING)[^/]*$'; then
			echo >&2 "WARNING: could not find copyright information for $module"
		fi
	done < <(awk '/^# /{ print $2 }' vendor/modules.txt)
}

if validate_vendor_tidy && validate_vendor_diff && validate_vendor_license; then
	echo >&2 'PASS: Vendoring has been performed correctly!'
else
	{
		echo 'FAIL: Vendoring was not performed correctly!'
		echo
		echo 'The following files changed during re-vendor:'
		echo
		git diff --name-status HEAD -- "${vendor_files[@]}"
		echo
		echo 'Please revendor with hack/vendor.sh'
		echo
		git diff --diff-filter=M -- "${vendor_files[@]}"
	} >&2
	exit 1
fi

How do you feel about a `VALIDATE(PASS):` prefix?