Return declared licenses from ParseResult

[abhinavgautam01]

Closes #49

Summary

Add declared license metadata to ParseResult, allowing consumers to access license information directly from supported package manifests.

This introduces:

• Licenses []string for raw declared license values
• LicenseFile string for a manifest-relative license file
• setup.cfg and OPAM manifest support
• Documentation and regression tests for the new fields

License values are returned without SPDX normalization, keeping this package independent of github.com/git-pkgs/spdx.

Supported formats

License metadata is extracted from:

• package.json and bower.json
• Cargo.toml
• pyproject.toml, setup.py, and setup.cfg
• *.gemspec
• *.podspec
• composer.json
• pom.xml
• *.nuspec
• *.cabal
• R DESCRIPTION
• mix.exs
• opam and *.opam
• elm.json and elm-package.json

Formats without declared license fields, such as go.mod and pubspec.yaml, continue to return empty values.

For formats that allow multiple license files, LicenseFile contains the first declared path, matching the singular public API proposed in the issue.

Validation

• gofmt
• git diff --check
• go build ./...
• go vet ./...
• go test ./...
• go test -race ./...
• golangci-lint — 0 issues

Follow-up hardening

A second review added coverage and fixes for:

• Package-style and application-style elm.json dependencies
• Comma-containing setup.cfg license values and version constraints
• One-line Elixir package/0 declarations
• Whitespace-tolerant NuSpec license types

[andrew]

1. internal/opam/opam.go:21 discards dependency constraints and hard-codes every scope to runtime. For example, ocaml {>= "5.0"} gets an empty version and dune {build} becomes runtime. Parse the formula alongside each name and add constraint and scope tests.

2. internal/pypi/pypi.go:374 uses Project.Name to decide whether to read tool.poetry.license. A valid hybrid file with [project] name and [tool.poetry] license = "MIT" returns no license. Base the fallback on whether [project] declares license metadata.

3. internal/maven/maven.go:92 treats unresolved URLs such as ${project.url}/LICENSE as manifest-relative files. This returns a path that cannot be read from the checkout. Reject unresolved properties or interpolate the URL before classifying it.

4. internal/opam/opam.go:102 fails the required lint command. opamTopLevelStrings has cognitive complexity 35, and gocritic reports two ifElseChain findings at lines 68 and 134. Refactor the parser until the configured checks succeed.

[abhinavgautam01]

Thanks for the review I’ve addressed all four points:

• OPAM dependency formulas are now parsed alongside each package name. Version constraints are retained, and scope filters such as build, with-test, and with-dev-setup are mapped appropriately. Regression tests cover constraints, scopes, multiple filters, and non-version filters.
• The Poetry license fallback now depends on whether [project] actually declares license metadata, so hybrid projects with a PEP 621 name and tool.poetry.license work correctly.
• Maven license URLs containing unresolved ${...} properties are no longer classified as manifest-relative files.
• The OPAM parser has been split into smaller scanner helpers, resolving the cognitive-complexity and ifElseChain findings.