fix: install the repo's Go version and surface license scanner failures

[alnr]

Problem

Every push to ory/cli master since 2026-06-12 fails the Licenses workflow (example run), and license checking has silently covered only 3 of ~34 Go dependencies since even longer (ory/cli's committed dep-licenses.csv has been stale since 2025-08-05).

Two causes:

1. Toolchain mismatch. licenses/setup pins Go 1.23. In repos whose go.mod requires a newer Go, the go command downloads that toolchain into the module cache and GOROOT points there. Under a module-cache GOROOT, go-licenses cannot identify standard-library packages, and every go-licenses report invocation dies with Package <std> does not have module info. This became fatal with fix: resolve licenses for versioned modules and module-only roots #175, which switched list-licenses to per-package go-licenses report calls (before that, a few module-root invocations happened to short-circuit and keep the job green while reporting almost nothing).
2. Masked exit codes. licenses pipes list-licenses into the engine, so only the engine's exit status counts, and list-licenses hides xargs failures behind a trailing grep. That's why the "Check licenses" step stayed green on PRs while the same scanner crashed — only the write step on master pushes (which redirects to a file) surfaced the failure.

Fix

• licenses/setup/action.yml: install the Go version from go.mod (go-version-file, same pattern as docs/cli-next), falling back to stable when there is no go.mod, so GOROOT is a regular installation.
• licenses/licenses, licenses/list-licenses: run with bash pipefail so any failing stage fails the check, and invoke go-licenses directly via bin_dir instead of a CWD-relative sh -c wrapper.

Verification

• make test (shellcheck + shfmt) passes.
• Against a clone of ory/cli with a native Go 1.26 toolchain: list-licenses exits 0 and reports 179 license lines (vs. 7 stale ones today), and the full list passes license-engine.sh — so ory/cli CI goes green after this merges, no new allowlist entries needed.
• Simulating the broken CI toolchain (GOTOOLCHAIN=go1.26.0): the current check script exits 0 (silent pass), the fixed one exits 1 with the go-licenses errors visible.

Follow-up after merge

licenses/install pins ORY_CI_REF=747531b for curl | sh consumers (e.g. make licenses in downstream repos). GitHub Actions consumers pick this fix up immediately via ORY_CI_ROOT, but the pin needs bumping to this PR's merge commit in a follow-up, as done after #178.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fbef1f24-311d-409c-9fea-02cb9363ed7e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}