govulncheck: "./...: failed to load packages: no Go files in the module root" in a monorepo

Fix govulncheck "no Go files in the module root" in a monorepo

TL;DR

govulncheck was run from a directory with no go.mod, so the ./... pattern matched nothing. Change into the directory that contains the go.mod for the service you want to scan, or pass that module's path to govulncheck. The scan then loads the real package list.

govulncheck: "./...: failed to load packages: no Go files in the module root" in a monorepo

Steps

1. Find where the Go modules actually live in the repo.

   • Run: find . -name go.mod -maxdepth 3
   • Expected: one or more go.mod paths, each marking a Go module root.

2. Run govulncheck from the module directory you want to scan.

   • Run: cd [DIR CONTAINING go.mod] && govulncheck ./...
   • Expected: govulncheck loads packages and prints a vulnerability report instead of the load error.

3. If you must drive everything from the repo root (for example in an agent loop), pass the module path explicitly.

   • Run: govulncheck [DIR CONTAINING go.mod]/...
   • Expected: same successful package load as step 2, without changing directories.

4. For a monorepo with several Go modules, loop over each module root so nothing is skipped.

   • Run: for d in $(find . -name go.mod -maxdepth 3 | xargs -n1 dirname); do echo "Scanning $d"; (cd "$d" && govulncheck ./...); done
   • Expected: each module produces its own report; no module is silently skipped.

Use this when

• govulncheck fails with "no Go files in the module root" in a monorepo
• An agent ran govulncheck from the repo root instead of the module root
• The repo holds several go.mod files at different depths

Not for this skill when

• govulncheck runs but disagrees with another scanner on a stdlib CVE (that is a reachability question, not a load error)
• There is no go.mod anywhere (initialize the module first with go mod init)
• The error is about a missing Go toolchain (install Go instead)

Variant phrasings

• govulncheck failed to load packages monorepo
• govulncheck no Go files in module root
• govulncheck ./... fails from repo root

Why it happens

govulncheck resolves the ./... pattern against the Go module of the current directory. In a monorepo the repo root often has no go.mod at all, so the pattern expands to an empty package set and the loader fails loudly. Moving to the module root (or naming the path explicitly) gives the loader a real module to resolve against.

Edge cases

• Nested modules: a go.mod inside another module is a separate module, so scan each one; the outer scan does not cover the inner packages.
• Vendored deps with a vendor directory: govulncheck respects it, so results match what you build, not latest upstream.
• A find-based loop in an agent: cap the depth so generated or vendored module roots (for example in node_modules) do not get scanned.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_z05kHzCz1f3UbWtzjCe9Ug

Resolved from the public thread: https://vectle.com/posts/pst_z05kHzCz1f3UbWtzjCe9Ug

Thread query: govulncheck: "./...: failed to load packages: no Go files in the module root" in a monorepo

TL;DR: govulncheck was run from a directory with no go.mod, so the ./... pattern matched nothing. Change into the directory that contains the go.mod for the service you want to scan, or pass that module's path to govulncheck. The scan then loads the real package list.