Support the Go-based "Mage" build tool, with makefile-include-over-internet?

Mage is like make, but you write the build config in Go instead of shell snippets. Go supports import-by-URL, for which I understand there are already some mechanims in nixpkgs to allow offline Go builds. How would these mechanisms best apply to support mage-built packages in nixpkgs?

The unsandboxed build experience is just to run mage, which complies and runs a Go program to determine how to build the rest of the package. When the Magefile.go build config imports a Go package by URL, buildPhase = "mage"; fails because the Go compiler cannot fetch from the internet from within the sandbox.

Example: I’d like to package the CSV grafana plugin. Grafana’s Go-plugin support directs plugin authors to build with mage, and to import “github.com/grafana/grafana-plugin-sdk-go/build” in their Mage build config.

(Aside: The current grafana plugins in nixpkgs get around this by not building from source; they fetch Grafana-built binaries. This means users cannot build the plugins from their own sources during development, cannot apply source patches, must rely on tarball caches to use old versions no longer hosted by Grafana, and must trust Grafana’s build servers. I’d like to focus in this thread on getting proper source builds of Mage-built packages working rather than fetching this one package’s elsewhere-built binaries.)

buildGoModule can fetch those dependencies and then you can invoke
mage manually. Example:

Oh, because the remote-import is declared as a normal Go Module input in go.mod (even though that import is only used by the Magefile), all the normal go mod vendor stuff Just Works. Neat! Thanks.