What is the correct way to tell golangci.com that a project should be run with GO111MODULE=on?

Despite having a go.mod file, and attempting to set the GO111MODULE environment variable in .golangci.yaml, the build log on golangci.com indicates that GOMOD=""

service:
  prepare:
    - export GO111MODULE=on
run:
  deadline: 90s
  skip-dirs:
    - (^|/)x509($|/)
    - (^|/)asn1($|/)
  modules-download-mode: readonly

linters-settings:
  gocyclo:
    min-complexity: 40
  depguard:
    list-type: blacklist
    packages:
      - ^golang.org/x/net/context$
      - github.com/gogo/protobuf/proto
      - encoding/asn1
      - crypto/x509

linters:
  disable-all: true
  enable:
    - gocyclo
    - gofmt
    - goimports
    - golint
    - megacheck
    - misspell
    - govet
    - depguard
    - deadcode
    - ineffassign
    - varcheck

https://golangci.com/r/github.com/google/certificate-transparency-go/pulls/538

print environment (0.1s)
$ go version
    go version go1.11.5 linux/amd64
$ go env
    GOARCH="amd64"
    GOBIN=""
    GOCACHE="/root/.cache/go-build"
    GOEXE=""
    GOFLAGS=""
    GOHOSTARCH="amd64"
    GOHOSTOS="linux"
    GOOS="linux"
    GOPATH="/go"
    GOPROXY=""
    GORACE=""
    GOROOT="/usr/local/go"
    GOTMPDIR=""
    GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
    GCCGO="gccgo"
    CC="gcc"
    CXX="g++"
    CGO_ENABLED="1"
    GOMOD=""
    CGO_CFLAGS="-g -O2"
    CGO_CPPFLAGS=""
    CGO_CXXFLAGS="-g -O2"
    CGO_FFLAGS="-g -O2"
    CGO_LDFLAGS="-g -O2"
    PKG_CONFIG="pkg-config"
    GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build452960053=/tmp/go-build -gno-record-gcc-switches"

setup golangci-lint (0.1s)
parse golangci-lint version from config
    No golangci-lint version in config, use default: "1.17.x"
find golangci-lint version
    Using golangci-lint v1.17.1
finding installed version: golangci-lint --version
    golangci-lint has version 1.17.1 built from 4ba2155 on 2019-06-10T09:06:49Z
installing golangci-lint v1.17.1
    golangci-lint of needed version is installed by default, no need to download

GOLANGCI_COM_RUN=1 golangci-lint run  --out-format=json --issues-exit-code=0  --deadline=5m  --new=false  --new-from-rev=  --new-from-patch=../changes.patch

Running error: context loading failed: failed to load program with go/packages: go [list -e -json -compiled=true -test=true -export=false -deps=true -find=false -mod=readonly -- ./...]:

exit status 1: build flag -mod=readonly only valid when using modules

I've removed modules-download-mode:readonly The result is that it doesn't seem to use go.mod to fetch dependencies, and fails enumerating packages:

 GOLANGCI_COM_RUN=1 golangci-lint run --out-format=json --issues-exit-code=0 --deadline=5m --new=false --new-from-rev= --new-from-patch=../changes.patch

Running error: context loading failed: failed to load program with go/packages: go [list -e -json -compiled=true -test=true -export=false -deps=true -find=false -- ./...]: exit status 1: go build golang.org/x/crypto/cryptobyte: no Go files in ...