Stop vendoring dependencies and use Go Module Mirror

[matoous]

It is no necessary to vendor modules after the introduction of Module Mirror and Checksum Database (https://blog.golang.org/module-mirror-launch) in Go 1.13 because even if any dependency breaks or gets deleted we would have enough time with the module mirror to fix it.

So when time comes (probably with GolangCI-Lint v2.0.0 or with Go 1.14 - when we will be able to drop support for Go 1.12) we can remove the vendor folder which would ease up the development. After that, the dependencies updates could be for example handled by dependabot. Also, the codebase would be leaner.

[ernado]

We don't need to drop the go1.12 support to remove vendoring

If you are running an earlier version of the go command, then you can use this service by setting
GOPROXY=https://proxy.golang.org in your local environment.

What we can potentially break by removing the vendor folder and providing the correct binaries via our usual godownloader/goreleaser pipeline? The go get github.com/golangci/golangci-lint will work on go1.12 until some dependency will be removed from github, but with GOPROXY=https://proxy.golang.org it will work even in that case.

UPD: we decided to postpone this until go1.14

[matoous]

Hi @ernado , do you think it might be the right time now?

[ernado]

I think it is time.