From 92bdf66f070ffb408417163b4cb2f22ab9b93bc5 Mon Sep 17 00:00:00 2001
From: Arne Luenser <arne.luenser@ory.sh>
Date: Tue, 18 Aug 2026 21:51:23 +0200
Subject: [PATCH] fix: install the repo's Go version and surface license
 scanner failures

The licenses setup action pins Go 1.23. In repos whose go.mod requires a
newer Go, the go command downloads that toolchain into the module cache,
where go-licenses cannot identify standard-library packages and every
`go-licenses report` invocation dies with "Package <std> does not have
module info". Install the Go version from go.mod instead (latest stable
when there is no go.mod), so GOROOT is a regular installation.

These failures went unnoticed because both scripts mask exit codes:
`licenses` pipes list-licenses into the engine, so only the engine's
status counts, and list-licenses hides xargs failures behind a grep.
Run both scripts with pipefail so any failing stage fails the check.

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
---
 licenses/licenses         |  4 ++--
 licenses/list-licenses    |  6 +++---
 licenses/setup/action.yml | 11 ++++++++++-
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/licenses/licenses b/licenses/licenses
index 25d3c9d..3a76a2c 100755
--- a/licenses/licenses
+++ b/licenses/licenses
@@ -1,5 +1,5 @@
-#!/bin/sh
-set -e
+#!/bin/bash
+set -eo pipefail
 
 # Get the directory where this script is located
 bin_dir="$(cd "$(dirname "$0")" && pwd)"
diff --git a/licenses/list-licenses b/licenses/list-licenses
index c0985d5..3db5d3b 100755
--- a/licenses/list-licenses
+++ b/licenses/list-licenses
@@ -1,5 +1,5 @@
-#!/bin/sh
-set -e
+#!/bin/bash
+set -eo pipefail
 
 bin_dir="$(cd "$(dirname "$0")" && pwd)"
 
@@ -32,7 +32,7 @@ if [ -f go.mod ]; then
 	if [ -z "$go_packages" ]; then
 		echo "No Go modules found" >&2
 	else
-		echo "$go_packages" | xargs -I {} sh -c '.bin/go-licenses report --template .bin/license-template-go.tpl {}' | grep -v '^$'
+		echo "$go_packages" | xargs -I {} "${bin_dir}/go-licenses" report --template "${bin_dir}/license-template-go.tpl" {} | grep -v '^$'
 		echo
 	fi
 fi
diff --git a/licenses/setup/action.yml b/licenses/setup/action.yml
index 9d9430e..5c3647a 100644
--- a/licenses/setup/action.yml
+++ b/licenses/setup/action.yml
@@ -13,9 +13,18 @@ runs:
         # a pull request then we can checkout the head.
         fetch-depth: 2
         token: ${{ inputs.token || github.token }}
+    # Install the Go version the repository requires. With a fixed, older
+    # version, the go command fetches the required toolchain into the module
+    # cache instead, where go-licenses cannot identify standard-library
+    # packages and fails with "Package <std> does not have module info".
     - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
+      if: hashFiles('go.mod') != ''
       with:
-        go-version: "1.23"
+        go-version-file: go.mod
+    - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
+      if: hashFiles('go.mod') == ''
+      with:
+        go-version: "stable"
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
         python-version: "3.13"