If you've ever dealt with a team where different people had different versions of linters installed, you'll quickly realize that you should also lock your tools.
Before Go 1.13 the recommended solution was to use tools.go file like this:
// +build tools
package tools
import (
_ "golang.org/x/lint/golint"
)
This way, go mod can pick the tool up and lock its version as well.
Now with go 1.13.x go mod tidy adds such dependencies to the module's go.mod and go.sum files.
If your dependencies on build tools are mixed with your run time dependencies