I just wanted to say thanks for contributing this tainted package. Your library was easy to integrate and helped solve a pain point.

When running tainted using vendored modules, there is no way to specify the vendor folder to look for modules into.
Instead, it tries to download them again, eventually failing if some of them is private or unreachable.

This seems to be a limitation of the build module, and it's suggested to switch to the packages module to fix this.

Hey, thanks for making this tool, I ran into a little snag:

If I have the following structure:

cmd/
    app1/
        main.go     <- imports package project
    app2/
         main.go
project.go          <-  package name:  project

and I make changes to project.go, app1 and app2 are not considered to be tainted. project.go is in the CWD, but seems to be ignored here

When I change the code to the following:

if dir := filepath.Dir(scanner.Text()); dir != "." {
	changedDirs[dir] = struct{}{}
} else {
	ctx := build.Default
	cwd, err := os.Getwd()
	if err != nil {
		log.Fatal(err)
	}
	p, err := ctx.ImportDir(cwd, build.FindOnly)
	if err != nil {
		log.Fatal(err)
	}
	changedDirs[p.ImportPath] = struct{}{}
}

I seem to get my desired outcome. I'm not sure if this the best way to handle this or not and was wondering what your thoughts are about this matter.

Thanks,

I noticed that if only a test file is updated, the package will be considered as changed.