[BUG] Fails for proper Golang licenses

[AndreasBergmeier6176]

Describe the bug
Tried it on our repo and it generates only false positives.

To Reproduce
Feel free to contact me for the internal details.

Expected behavior
Should not produce false positives.

Screenshots/Logs
This is what it looks like in GitHub Insights:

This is what it writes in the zip:

Environment:

• Runner OS: ubuntu-latest
• Action version: 0.4.2

[christianherweg0807]

📋 Implementation Plan: Golang License Support

Thank you for reporting this issue! I've analyzed the problem and developed a comprehensive implementation plan.

🔍 Root Cause Analysis

The action currently fails for Golang packages because:

1. deps.dev API doesn't support Golang packages - returns 404 for all pkg:golang/* PURLs
2. Go modules don't include license metadata in go.mod files
3. Our enrichment pipeline has no Golang-specific resolver

✅ Solution Strategy

Since most Go modules are hosted on GitHub and GitHub's API provides complete license data with SPDX IDs, we'll implement a GitHub-based license resolver specifically for Golang packages.

🚀 Implementation Steps

Step 1: Create golang_resolver.py

New dedicated resolver for Golang packages with:

• is_golang_package(purl) - Detect Golang PURLs
• extract_github_repo(purl) - Parse PURL to GitHub repository
• resolve_golang_license_from_github(purl, github_token=None) - Main resolver using GitHub API
• get_golang_stdlib_license(purl) - Handle golang.org/x/* stdlib packages

Example PURL mappings:

pkg:golang/github.com/spf13/cobra@v1.8.0 → github.com/spf13/cobra
pkg:golang/golang.org/x/text@v0.14.0 → golang/text (stdlib → BSD-3-Clause)
pkg:golang/gopkg.in/yaml.v2 → go-yaml/yaml

Step 2: Integrate into enrich_sbom.py

Modify _resolve_license_from_depsdev():

def _resolve_license_from_depsdev(self, purl, package_name):
    # NEW: Check for Golang packages first
    if is_golang_package(purl):
        golang_license = resolve_golang_license_from_github(purl, github_token)
        if golang_license:
            self.resolution_stats['golang_github'] += 1
            return golang_license
    
    # Existing deps.dev logic continues...

Step 3: GitHub API Integration

• Use GitHub REST API: GET /repos/{owner}/{repo}/license
• Support optional GitHub token via environment variable GITHUB_TOKEN
• Rate limits: 60/hour (unauthenticated) vs 5000/hour (authenticated)
• Fallback to existing AI resolver if GitHub API fails

Step 4: Special Cases Handling

Handle common Golang package patterns:

GOLANG_STDLIB = {
    'golang.org/x/*': 'BSD-3-Clause',
    'google.golang.org/*': 'BSD-3-Clause',
}

GOLANG_HOSTING_MAPPINGS = {
    'gopkg.in': lambda path: convert_gopkg_to_github(path),
    'go.uber.org': lambda path: f'uber-go/{path}',
}

Step 5: Testing

• Test with real Golang SBOMs
• Cover all PURL formats (github.com, golang.org, gopkg.in)
• Test rate limiting behavior
• Validate SPDX ID extraction

Step 6: Documentation

• Update README with Golang support details
• Document GitHub token configuration (optional but recommended)
• Add Golang-specific examples

📊 Expected Outcomes

✅ 90%+ automatic license detection for Go packages via GitHub API
✅ Direct SPDX IDs (no fuzzy matching needed)
✅ Backwards compatible - no breaking changes
✅ Fallback chain: GitHub → AI → needs-review
✅ Statistics tracking for Golang resolution in audit summaries

⚠️ Considerations

1. GitHub Token: Recommended for higher rate limits (5000/hour vs 60/hour)
2. Private repositories: Not accessible without appropriate token permissions
3. Non-GitHub packages: Will fall back to AI resolver or needs-review
4. Version-specific licenses: GitHub API shows current branch license (usually acceptable)

🕐 Estimated Effort

• Code implementation: 2-3 hours
• Testing & validation: 1-2 hours
• Documentation: 1 hour
• Total: ~4-6 hours

📝 Next Steps

I can start implementation immediately. Would you be able to provide:

1. A sample SBOM from your repository (anonymized if needed) for testing?
2. Any specific Golang packages that are currently failing?
3. ...
   This will help me validate the solution against your actual use case and ensure it resolves your false positives issue.