vendor: dependencies that become unused are left over

[andreimatei]

If the last import of a vendored dependency goes away, nothing forces the commit in question to remove the dependency from the vendored repo. Worse, the next sucker who runs dep ensure to muck with some other dependency will have the surprise of seeing the useless dependency removed at that point, unexpectedly. Which is very confusing, and a pain to figure out why and how.

We have a check that TC is supposed to do to ensure that the vendored repo is copacetic, but it fails to catch this case. The check in question only runs when dependencies change, not when our imports change:

cockroach/pkg/cmd/github-pull-request-make/main.go

Line 220 in 275e620

for _, path := range []string{"Gopkg.lock", "vendor"} {

This has just happened when @otan deleted some imports here. @dt helped me figure it out.

I think we should run a dep ensure nightly to catch this.

Epic CRDB-10447

Jira issue: CRDB-5015

[bobvawter]

This would be obviated by switching the build to go modules per #38824

[github-actions]

We have marked this issue as stale because it has been inactive for
18 months. If this issue is still relevant, removing the stale label
or adding a comment will keep it active. Otherwise, we'll close it in
10 days to keep the issue queue tidy. Thank you for your contribution
to CockroachDB!

[rickystewart]

This should be resolved by go mod tidy, etc.