From ba39e413e0e93d28226bb7fc2d4bc239871cc270 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Wa=C5=82ach?= <adam.walach@gmail.com>
Date: Mon, 25 May 2026 21:15:14 +0200
Subject: [PATCH] fix: resolve licenses for versioned modules and module-only
 roots

Replace the module-path string transformation with a `go list -deps`
walk that picks one importable package per direct module and feeds
those to `go-licenses report`.

Calling `go-licenses report <module>` directly fails for two common
patterns:

- Versioned modules carry a /vN suffix that must be present verbatim.
  The previous awk truncated `github.com/dgraph-io/ristretto/v2` to
  `github.com/dgraph-io/ristretto`, which is not a valid module path
  for v2+ modules.

- Some module roots have no Go file of their own; only sub-packages
  are importable. `cloud.google.com/go/secretmanager` is an example:
  only `apiv1/...` exists as a package, so `go list` on the root
  returns "no required module provides package".

Walking the actual import graph sidesteps both problems.
---
 licenses/list-licenses | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/licenses/list-licenses b/licenses/list-licenses
index 8a238d9..c0985d5 100755
--- a/licenses/list-licenses
+++ b/licenses/list-licenses
@@ -16,23 +16,23 @@ fi
 
 # list Go licenses
 if [ -f go.mod ]; then
-	# List all direct Go module dependencies, transform their paths to root module paths
-	# (e.g., github.com/ory/x instead of github.com/ory/x/foo/bar), and generate a license report
-	# for each unique root module. This ensures that the license report is generated for the root
-	# module of a repository, where licenses are typically defined.
-	go_modules=$(
-		go list -f "{{if not .Indirect}}{{.Path}}{{end}}" -m ... |
-			sort -u |
-			awk -F/ '{ if ($1 == "github.com" && NF >= 3) { print $1"/"$2"/"$3 } else { print } }' |
-			sort -u
+	# For each direct Go module dependency, pick one importable package and let
+	# go-licenses report on it. Calling `go-licenses report <module>` directly
+	# does not work for two common cases:
+	#   - Versioned modules carry a /vN suffix that must be present verbatim
+	#     (github.com/golang-jwt/jwt/v5, github.com/dgraph-io/ristretto/v2).
+	#   - Some module roots have no Go file of their own; only sub-packages
+	#     are importable (cloud.google.com/go/secretmanager -> .../apiv1).
+	# Walking the actual import graph with `go list -deps` sidesteps both.
+	go_packages=$(
+		go list -deps -f '{{if .Module}}{{if not .Module.Main}}{{if not .Module.Indirect}}{{.Module.Path}}|{{.ImportPath}}{{end}}{{end}}{{end}}' ./... |
+			sort -u -t'|' -k1,1 |
+			cut -d'|' -f2
 	)
-	if [ -z "$go_modules" ]; then
+	if [ -z "$go_packages" ]; then
 		echo "No Go modules found" >&2
 	else
-		# Workaround until https://github.com/google/go-licenses/issues/307 is fixed
-		# .bin/go-licenses report "$module_name" --template .bin/license-template-go.tpl 2>/dev/null
-		#
-		echo "$go_modules" | xargs -I {} sh -c '.bin/go-licenses report --template .bin/license-template-go.tpl {}' | grep -v '^$'
+		echo "$go_packages" | xargs -I {} sh -c '.bin/go-licenses report --template .bin/license-template-go.tpl {}' | grep -v '^$'
 		echo
 	fi
 fi