Use host module cache whithout build cache and verify it

cmd/fetch_repo/BUILD.bazel

@@ -9,7 +9,10 @@ go_library(
     ],
     importpath = "github.com/bazelbuild/bazel-gazelle/cmd/fetch_repo",
     visibility = ["//visibility:private"],
-    deps = ["@org_golang_x_tools_go_vcs//:vcs"],
+    deps = [
+        "@org_golang_x_mod//sumdb/dirhash",
+        "@org_golang_x_tools_go_vcs//:vcs",
+    ],
 )
 
 go_binary(

cmd/fetch_repo/module.go

@@ -27,6 +27,8 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+
+	"golang.org/x/mod/sumdb/dirhash"
 )
 
 func fetchModule(dest, importpath, version, sum string) error {
@@ -114,7 +116,22 @@ func fetchModule(dest, importpath, version, sum string) error {
 	}
 
 	// Copy the module to the destination.
-	return copyTree(dest, dl.Dir)
+	err = copyTree(dest, dl.Dir)
+	if err != nil {
+		return fmt.Errorf("failed copying repo: %w", err)
+	}
+
+	// Verify sum
+	repoSum, err := dirhash.HashDir(dest, importpath+"@"+version, dirhash.Hash1)
+	if err != nil {
+		return fmt.Errorf("failed computing sum: %w", err)
+	}
+
+	if repoSum != sum {
+		return fmt.Errorf("resulting module with sum %s; expected sum %s", repoSum, sum)
+	}
+
+	return nil
 }
 
 func copyTree(destRoot, srcRoot string) error {

internal/go_repository.bzl

@@ -25,7 +25,9 @@ When `go_repository` is in module mode, it saves downloaded modules in a shared,
 internal cache within Bazel's cache. It may be cleared with `bazel clean --expunge`.
 By setting the environment variable `GO_REPOSITORY_USE_HOST_CACHE=1`, you can
 force `go_repository` to use the module cache on the host system in the location
-returned by `go env GOPATH`.
+returned by `go env GOPATH`. Alternatively, by setting the environment variable
+`GO_REPOSITORY_USE_HOST_CACHE=1`, you can force `go_repository` to use only
+the module cache on the host system in the location returned by `go env GOMODCACHE`.
 
 **Example**
 

internal/go_repository_cache.bzl

@@ -39,6 +39,12 @@ def _go_repository_cache_impl(ctx):
     go_path = str(ctx.path("."))
     go_cache = str(ctx.path("gocache"))
     go_mod_cache = ""
+    if ctx.os.environ.get("GO_REPOSITORY_USE_HOST_MODCACHE", "") == "1":
+        extension = executable_extension(ctx)
+        go_tool = go_root + "/bin/go" + extension
+        go_mod_cache = read_go_env(ctx, go_tool, "GOMODCACHE")
+        if not go_mod_cache:
+            fail("GOMODCACHE must be set when GO_REPOSITORY_USE_HOST_MODCACHE is enabled.")
     if ctx.os.environ.get("GO_REPOSITORY_USE_HOST_CACHE", "") == "1":
         extension = executable_extension(ctx)
         go_tool = go_root + "/bin/go" + extension

repository.md

@@ -115,7 +115,9 @@ When `go_repository` is in module mode, it saves downloaded modules in a shared,
 internal cache within Bazel's cache. It may be cleared with `bazel clean --expunge`.
 By setting the environment variable `GO_REPOSITORY_USE_HOST_CACHE=1`, you can
 force `go_repository` to use the module cache on the host system in the location
-returned by `go env GOPATH`.
+returned by `go env GOPATH`. Alternatively, by setting the environment variable
+`GO_REPOSITORY_USE_HOST_CACHE=1`, you can force `go_repository` to use only
+the module cache on the host system in the location returned by `go env GOMODCACHE`.
 
 **Example**
 

vendor/modules.txt

@@ -29,6 +29,7 @@ golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
+golang.org/x/mod/sumdb/dirhash
 # golang.org/x/sync v0.5.0
 ## explicit; go 1.18
 golang.org/x/sync/errgroup