License audit for Go/npm

[fridolin-koch]

Hello,

we are currently evaluating Ultimate Plus and I'm testing with multiple technologies in use. It seems like that for Go and JS/NPM there is no dependency / licence report available. I did the setup from the cloud console and then modified the config a bit but I never saw any licence. What setup steps are needed so the Go/JS reporting works like the Java/Kotlin reporting where a complete list of all dependencies/licences is available?

Thank you!

Here is the config:

version: "1.0"
linter: jetbrains/qodana-go:2025.2
profile:
  name: qodana.recommended

bootstrap: |
  go mod download
  go mod tidy

include:
  - name: CheckDependencyLicenses
  - name: GrazieInspection
  - name: VgoDependencyDeprecated
  - name: VgoDependencyVersionRetracted
  - name: CheckModuleLicenses
  - name: CheckThirdPartySoftwareList

and the relevant GHA step

name: Qodana
on:
  workflow_dispatch:
  pull_request:
  push:
    branches: # Specify your branches here
      - main # The 'main' branch

jobs:
  qodana:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      checks: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
          fetch-depth: 0  # a full history is required for pull request analysis
      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@v1
        with:
          # redacted

      - run: git config --global url.https://x-access-token:${GH_ACCESS_TOKEN}@github.com/.insteadOf https://github.com/
        env:
          GH_ACCESS_TOKEN: ${{ steps.generate-token.outputs.token }}

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.2
        with:
          pr-mode: false
          args: |
            --linter,qodana-go,
            --within-docker,false
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
          QODANA_ENDPOINT: 'https://qodana.cloud'

[brichbash]

Hi,

For Go there are no additional steps required, however for the JS linter, the project dependencies should be downloaded before running the analysis.

You can do that either by running a command like npm install in a step before Qodana, or you can add to qodana.yaml:

bootstrap: |
  npm install # depends on your dependency management tool

The bootstrap will run the specified command before analysis.

Please make sure that your Qodana Cloud organization indeed has the Qodana Ultimate Plus license, you can check it on Qodana Cloud in Settings | Subscription and that the project token you're using comes from that organization

[fridolin-koch]

Thanks for the feedback, for npm/js it works now as expected. But not for Go, are there any logs I can check?

[brichbash]

Yes, please set upload-result to true in the Qodana action inputs, i.e.

- name: 'Qodana Scan'
  uses: JetBrains/qodana-action@v2025.2
  with:
    upload-result: true
    ...

Then rerun Qodana and share the log/idea.log from the resulting artifact. You can share it here (the logs can contain sensitive information, i.e. project/file names, used dependencies etc.) or send it to qodana-support@jetbrains.com