From a70145772566bcf41a97b8f5ae28afd1bc131ad8 Mon Sep 17 00:00:00 2001
From: Jacob Sussmilch <suisuss@protonmail.com>
Date: Wed, 29 Jul 2026 11:40:38 +1000
Subject: [PATCH] fix: KEEP-1056 pin cobra/doc tooling deps so go mod tidy
 stops pruning go.sum

generate.go carries //go:build ignore, so go mod tidy never sees its import
of github.com/spf13/cobra/doc and prunes go-md2man and blackfriday from
go.sum. Doc generation then fails with a missing go.sum entry. Dependabot
runs tidy on every bump, so this broke docs-check on PRs #36, #37 and #81.

Add a tools-tagged blank import. go mod tidy evaluates imports under all
build tag combinations, unlike the compiler, so the tag keeps the file out
of every real build while holding those hashes pinned. Verified: tidy now
leaves go.sum untouched, and go list -deps ./cmd/kh has no md2man.

Also promote golang.org/x/crypto out of the indirect block: cmd/read/read.go
imports it directly, so go.mod was not tidy-clean and any tidy run moved it.
---
 docs/tools.go | 14 ++++++++++++++
 go.mod        |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 docs/tools.go

diff --git a/docs/tools.go b/docs/tools.go
new file mode 100644
index 0000000..3daea20
--- /dev/null
+++ b/docs/tools.go
@@ -0,0 +1,14 @@
+//go:build tools
+
+package docs
+
+// generate.go carries `//go:build ignore`, so `go mod tidy` cannot see its
+// import of cobra/doc and prunes go-md2man and blackfriday from go.sum. Doc
+// generation then fails with a missing go.sum entry, which is what broke the
+// docs check on every dependabot module bump.
+//
+// This blank import is what stops that. `go mod tidy` evaluates imports under
+// all build tag combinations, unlike the compiler, so the `tools` tag keeps the
+// file out of every real build while still holding those hashes pinned.
+
+import _ "github.com/spf13/cobra/doc"
diff --git a/go.mod b/go.mod
index 91fb393..5273575 100644
--- a/go.mod
+++ b/go.mod
@@ -11,6 +11,7 @@ require (
 	github.com/modelcontextprotocol/go-sdk v1.4.0
 	github.com/spf13/cobra v1.10.0
 	github.com/stretchr/testify v1.11.1
+	golang.org/x/crypto v0.46.0
 	golang.org/x/term v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -47,7 +48,6 @@ require (
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	gitlab.com/gitlab-org/api/client-go v1.9.1 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.32.0 // indirect