Good practice for go mod and go get

Still new dev in Go here.
I am wondering what is the best practice in the usage of go mod and go get.
I have go.mod file, containing only modules related to run a production build.
During the pipeline, I do want to run some code quality check, such as go vet/lint and other tests.

To run this, I need to get get some additional modules. But once I do this, my go.mod gets updated, but not vendor/modules.txt, which create some issues.

I see 2 solutions to this, but both seem incorrect:

1-I run a go mod vendor after the go get, this will update all files I need. Not particularly annoying, but it seems weird to me to have to call two different command in order to update my modules.

2-I put by default the modules needed for the linting/tests and other check in my go.mod file. But that sounds weird to me, production build does not need the linting modules, I should not have to publish them.

Am I overthinking this, and I should just go with 2? Or is there an other good practice here?

> I put by default the modules needed for the linting/tests and other check in my go.mod file. But that sounds weird to me, production build does not need the linting modules, I should not have to publish them.

Yes, you should do this. Your go.mod contains everything needed to work with your project, not just everything needed for a production build. There is no harm in including non-production dependencies there. Dependencies that are not used by your production binary are simply not included in the binary.