feat(go-licenses): add composite action with check + report modes

[sydorovdmytro]

Why

Reusable workflows can't resolve their own ref at call time — both github.workflow_ref and github.workflow_sha leak the caller's context under workflow_call, so any sparse-checkout of loft-sh/github-actions for scripts fails on PR-triggered callers with:

fatal: couldn't find remote ref refs/pull/N/merge

This was just observed in the sibling govulncheck work (loft-enterprise#6676) and fixed by converting to a composite action in #109. github.job_workflow_sha is documented but only exposed as an OIDC claim (actions/runner#2417).

Ship go-licenses as a composite action from the start to avoid the same bug class — the pattern already used by ci-test-notify, release-notification, linear-release-sync, semver-validation, and govulncheck.

What

One composite action at .github/actions/go-licenses/ with a mode: check|report input, rather than two separate actions. Both modes share ~90% of the setup (setup-go, install go-licenses, private-repo git auth); only the trailing steps differ (go-licenses check vs go-licenses report + peter-evans/create-pull-request). The existing run.sh with check/report subcommands ports unchanged.

Caller contract

Each caller provides their own actions/checkout, runs-on, timeout-minutes, and fork guard at the job level.

Check mode:

jobs:
  check:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'loft-sh'
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: loft-sh/github-actions/.github/actions/go-licenses@go-licenses/v1
        with:
          mode: check
          gh-access-token: ${{ secrets.GH_ACCESS_TOKEN }}

Report mode:

jobs:
  report:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'loft-sh'
    permissions:
      contents: write
      pull-requests: write
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: loft-sh/github-actions/.github/actions/go-licenses@go-licenses/v1
        with:
          mode: report
          template-path: .github/licenses.tmpl
          output-path: docs/pages/licenses/vcluster.mdx
          pr-branch: licenses/vcluster
          pr-title: "Update vcluster licenses"
          gh-access-token: ${{ secrets.GH_ACCESS_TOKEN }}

Files

• .github/actions/go-licenses/action.yml — composite action
• .github/actions/go-licenses/run.sh — unchanged, moved from .github/scripts/
• .github/actions/go-licenses/test/run.bats — unchanged, 17 tests
• .github/actions/go-licenses/README.md — inputs + usage
• .github/workflows/test-go-licenses.yaml — path filter retargeted
• Makefile — test-go-licenses now points at ACTIONS_DIR

Test plan

• make test-go-licenses — 17/17 bats tests pass
• make lint — actionlint + zizmor clean
• shellcheck .github/actions/go-licenses/run.sh — clean
• Script executable (mode 100755)
• CI green on this PR
• After merge: push go-licenses/v1 tag; migrate callers (vcluster, vcluster-pro, loft-enterprise)

Refs DEVOPS-772