Replace `google/go-licenses` with custom generation by silverwind · Pull Request #36575 · go-gitea/gitea

silverwind · 2026-02-10T02:27:22Z

Rewrite build/generate-go-licenses.go to use go list -m -json all and read license files directly from the Go module cache instead of relying on the buggy google/go-licenses tool.

This removes the need for CGO, GOOS=linux, and the intermediate temp directory, while being like 100 times faster than before:

$ rm assets/go-licenses.json && time make assets/go-licenses.json
go run build/generate-go-licenses.go assets/go-licenses.json
make assets/go-licenses.json  0.21s user 0.22s system 173% cpu 0.247 total

…eration Rewrite build/generate-go-licenses.go to use `go list -m -json all` and read license files directly from the Go module cache instead of relying on the external google/go-licenses tool. This removes the need for CGO, GOOS=linux, and the intermediate temp directory, while producing more complete output (350 vs 269 entries). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR rewrites the Go license generation pipeline to avoid github.com/google/go-licenses, instead enumerating modules via go list -m -json all and reading license files directly from each module’s local directory.

Changes:

Replaced the go-licenses-based workflow with a new module-cache scanning implementation in build/generate-go-licenses.go.
Simplified the Makefile go-licenses target to a single go run invocation (no temp dir, no CGO/GOOS requirements).
Removed .go-licenses artifacts from .gitignore and tar exclusions.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 5 comments.

File	Description
build/generate-go-licenses.go	New implementation that shells out to `go list -m -json all` and scans module dirs for license files.
Makefile	Removes `go-licenses` tool install/temp-dir steps and calls the generator directly.
.gitignore	Drops ignore entry for the removed `.go-licenses` temp directory.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

build/generate-go-licenses.go

Makefile

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/generate-go-licenses.go

Signed-off-by: silverwind <me@silverwind.io>

Copilot

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Makefile

assets/go-licenses.json

Use `go list -deps` to determine which modules are real non-test dependencies, excluding tool deps (e.g. gitea-vet) and test-only transitive deps (e.g. xorm/sqlfiddle). Scan main module subdirectories for separate LICENSE files to restore entries like modules/lfs which has distinct copyright attribution. Also fix JSON decoder to use io.EOF instead of dec.More() for streaming top-level objects. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind · 2026-02-12T20:54:56Z

After last change license count is now 267, very close to main's 265. Likely because of elimination of test-only dependencies.

$ rg name.+gitea/modules/lfs assets/go-licenses.json
13:    "name": "code.gitea.io/gitea/modules/lfs",
$ rg name.+gitea-vet assets/go-licenses.json
$ rg name.+sqlfiddle assets/go-licenses.json

assets/go-licenses.json

Use GOOS=linux with CGO in go list -deps to capture all platform-specific dependencies, matching the CI environment. Skip gitignored files in subdirectory license scanning to avoid including local-only files. Skip internal directories. Add ignoredModulePaths for excluding non-third-party license files. Run the two go list commands in parallel. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove the getTrackedFiles/git-ls-files mechanism and sync.WaitGroup concurrency as they are unnecessary — the directory skip list in findSubdirLicenses already excludes all relevant directories. Add "public" to the skip list to handle the one edge case. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…enses Replace the separate findSubdirLicenses tree walk with package-directory scanning in findLicenseFiles, handling both dependency and main modules uniformly. This restores 11 subdirectory licenses with unique terms that were previously missed and reduces the overall diff. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind · 2026-02-15T09:03:51Z

Did a few more refactorings to reduce diff in both the license file and the generation script. Looks pretty good to me now.

build/generate-go-licenses.go

Signed-off-by: silverwind <me@silverwind.io>

When a module directory contains multiple license files, prefer primary files (LICENSE, LICENCE, COPYING) over variants with suffixes (LICENSE.docs, LICENSE-2.0.txt). If no primary file exists, keep only the first variant. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind · 2026-02-16T08:04:28Z

@lunny check the license output diff again please, I think it's pretty minimal now.

assets/go-licenses.json

TheFox0x7

I think you can just hardcode the 2 that the tool missed and it'll be good.
We're probably can do better with the notices but what matters most is that there's no regression in compliance.

Shame there's no OSS software that does it properly that I could find and verify on this...
From commercial side FOSSA has something but it's also not great.

assets/go-licenses.json

Walk up from each package directory to the module root, scanning all intermediate parent directories for license files with unique text. This restores two internal vendored licenses that were previously missed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind · 2026-02-18T01:31:19Z

Both requested licenses restored.

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Feb 10, 2026

github-actions bot added modifies/go Pull requests that update Go code modifies/internal labels Feb 10, 2026

silverwind requested a review from Copilot February 10, 2026 02:31

Copilot started reviewing on behalf of silverwind February 10, 2026 02:31 View session

silverwind changed the title ~~Replace google/go-licenses with custom generation~~ Replace google/go-licenses with custom generation Feb 10, 2026

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Address review: use GO env var and add warnings for file errors

e3e80f3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind commented Feb 10, 2026

View reviewed changes

build/generate-go-licenses.go Show resolved Hide resolved

Apply suggestion from @silverwind

2e95d72

Signed-off-by: silverwind <me@silverwind.io>

silverwind mentioned this pull request Feb 10, 2026

Build licenses.txt with trivy #35659

Closed

fmt

29a3f7d

silverwind requested a review from Copilot February 10, 2026 07:00

Copilot started reviewing on behalf of silverwind February 10, 2026 07:01 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Makefile Show resolved Hide resolved

silverwind added 2 commits February 11, 2026 19:49

Merge branch 'main' into golic

00c98c4

Merge branch 'main' into golic

e497375

lunny reviewed Feb 12, 2026

View reviewed changes

assets/go-licenses.json Outdated Show resolved Hide resolved

lunny reviewed Feb 12, 2026

View reviewed changes

assets/go-licenses.json Show resolved Hide resolved

lunny reviewed Feb 12, 2026

View reviewed changes

assets/go-licenses.json Outdated Show resolved Hide resolved

lunny reviewed Feb 12, 2026

View reviewed changes

assets/go-licenses.json Outdated Show resolved Hide resolved

silverwind force-pushed the golic branch from 12c0741 to accc70c Compare February 13, 2026 06:32

silverwind and others added 2 commits February 13, 2026 07:34

Regenerate go-licenses.json

426dfbf

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

silverwind force-pushed the golic branch from accc70c to 426dfbf Compare February 13, 2026 06:34

Add instruction to never force-push to PR branches

1f49c4b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions bot added the modifies/docs label Feb 13, 2026

Merge branch 'main' into golic

330641f

silverwind mentioned this pull request Feb 14, 2026

Update AGENTS.md instructions #36627

Merged

remove AGENTS.md change

e95afd5

github-actions bot removed the modifies/docs label Feb 14, 2026

This comment was marked as resolved.

Sign in to view

silverwind and others added 3 commits February 15, 2026 09:29

Merge branch 'main' into golic

9ea9a01

silverwind commented Feb 15, 2026

View reviewed changes

build/generate-go-licenses.go Outdated Show resolved Hide resolved

silverwind and others added 2 commits February 15, 2026 10:09

Apply suggestion from @silverwind

3be3448

Signed-off-by: silverwind <me@silverwind.io>

lunny reviewed Feb 17, 2026

View reviewed changes

assets/go-licenses.json Show resolved Hide resolved

TheFox0x7 approved these changes Feb 17, 2026

View reviewed changes

assets/go-licenses.json Show resolved Hide resolved

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Feb 17, 2026

lunny approved these changes Feb 18, 2026

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Feb 18, 2026

silverwind enabled auto-merge (squash) February 18, 2026 03:18

Merge branch 'main' into golic

b0ab562

silverwind added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 18, 2026

Merge branch 'main' into golic

62fc7e7

silverwind merged commit b9d323c into go-gitea:main Feb 18, 2026
24 checks passed

GiteaBot added this to the 1.26.0 milestone Feb 18, 2026

GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 18, 2026

silverwind deleted the golic branch February 18, 2026 05:15

Uh oh!

Conversation

silverwind commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

silverwind commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

silverwind commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

silverwind commented Feb 16, 2026

Uh oh!

Uh oh!

TheFox0x7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

silverwind commented Feb 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

silverwind commented Feb 10, 2026 •

edited

Loading

silverwind commented Feb 12, 2026 •

edited

Loading

silverwind commented Feb 15, 2026 •

edited

Loading