NOTICE.MD generation improvements (#1281)

In my upcoming SQL lexer/parser code I plan to use snippets of lexing
logic taken from other existing projects. Since such usage is not adding
a new Go dependency, this wouldn't get reflected in our top-level
`NOTICE.MD`.

Therefore, I implemented some improvements/cleaned up our generation of
`NOTICE.MD` file:

- Dependencies are taken from all `go.sum` files, not only
`quesma/go.sum` (important if we introduce new Go packages)
- Some of the logic is extracted to `collect-go-dependencies.sh`
- `collect-manual-notices.sh` appends manually created `NOTICE.MD`
entries from subdirectories (I will use that in my lexer PR)
- a few smaller improvements, cleanups

Author: avelanarius

.github/go-licence-detector/templates/dependencies.asciidoc.tmpl

@@ -0,0 +1,12 @@
+#!/bin/bash -e
+
+for gomod in **/go.mod ; do
+  pushd "$(dirname "$gomod")" 1>&2
+  echo "Processing $gomod" 1>&2
+
+  go mod tidy 1>&2
+  go mod download all 1>&2
+  go list -m -json all | jq -c
+
+  popd 1>&2
+done

.github/notice-generator/collect-go-dependencies.sh

@@ -0,0 +1,12 @@
+#!/bin/bash -e
+
+# Collect manually created notices we might have in the repository
+# (for example if we use code from a project, but that project isn't
+# a Go dependency of our project)
+
+for notice in **/NOTICE.MD ; do
+  if [ -f "$notice" ]; then
+    echo "" # newline between added notices
+    cat "$notice"
+  fi
+done

.github/notice-generator/collect-manual-notices.sh

@@ -5,15 +5,14 @@ on:
     branches:
       - main
     paths:
-      - 'quesma/go.mod'
-      - 'quesma/go.sum'
+      - '**/go.mod'
+      - '**/go.sum'
+      - '**/NOTICE.MD'
+      - '.github/notice-generator/**'
   workflow_dispatch:
 
 jobs:
   generate-notice-file:
-    strategy:
-      matrix:
-        module: [ "quesma" ]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -25,20 +24,17 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          cache-dependency-path: ${{ matrix.module }}/go.sum
+          cache-dependency-path: '**/go.sum'
           go-version: '1.24'
 
       - name: Install go-licence-detector
-        working-directory: ${{ matrix.module }}
-        run: go get go.elastic.co/go-licence-detector && go install go.elastic.co/go-licence-detector
+        run: go install go.elastic.co/[email protected]
 
       - name: Generate NOTICE.MD
-        working-directory: ${{ matrix.module }}
         run: |
-          go mod tidy
-          go mod download all
-          go list -m -json all | jq 'select(.Path != "quesma_v2")' | go-licence-detector -includeIndirect -noticeTemplate=../.github/go-licence-detector/templates/NOTICE.MD.tmpl -noticeOut=../NOTICE.MD -depsTemplate=../.github/go-licence-detector/templates/dependencies.asciidoc.tmpl -depsOut=dependencies.asciidoc -overrides=../.github/go-licence-detector/overrides.ndjson -rules=../.github/go-licence-detector/rules.json
-          rm dependencies.asciidoc
+          rm NOTICE.MD
+          .github/notice-generator/collect-go-dependencies.sh | sort | uniq | go-licence-detector -includeIndirect -noticeTemplate=.github/notice-generator/go-licence-detector/NOTICE.MD.tmpl -noticeOut=NOTICE.MD -overrides=.github/notice-generator/go-licence-detector/overrides.ndjson -rules=.github/notice-generator/go-licence-detector/rules.json
+          .github/notice-generator/collect-manual-notices.sh >> NOTICE.MD
 
       - name: Print NOTICE.MD
         run: cat NOTICE.MD