Should I commit the go.sum file to a Git repository?
Hello! I started learning Go and am transitioning from using GOPATH to Go Modules. I have a project that uses several external dependencies. I initialized the module with the `go mod init` command and added dependencies via `go get`. As a result, two files appeared: `go.mod` and `go.sum`.
I understand that `go.mod` needs to be committed — it's like `package.json` or `requirements.txt`. But with `go.sum`, it's not so obvious. I see that it's a huge file with hashes that constantly changes. For example, currently in my project I have the dependency `github.com/gin-gonic/gin v1.9.1`, and `go.sum` contains dozens of lines with hashes for this and other libraries.
My team lead says that `go.sum` needs to be committed to ensure reproducible builds. But I've read that some developers don't commit it because