With the merge of #4208 we're now downloading go modules in CircleCI, which should not happen. For example:
https://app.circleci.com/pipelines/github/cri-o/cri-o/6356/workflows/6223bde7-3cc2-4f16-a201-7ff5923d5ec3/jobs/102326/parallel-runs/0/steps/0-105

Either we remove the vendoring completely or we stick to the vendored sources. The issue seems to be introduced by the removal of the --mod=vendor flag.