From 2a5b0860208ce1e12b3244ca8ec152cc31821688 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sun, 23 Aug 2026 10:35:46 +0100
Subject: [PATCH] fix: ship vendor/ in the release archive so the catalog can
 import

The Traefik Plugin Catalog analyzer rejected v1.0.43:

  import "github.com/lukaszraczylo/oss-telemetry" error:
  unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"

piceus fetches the source archive at the released tag and interprets it
with Yaegi. It never runs go mod download, so every non-stdlib import in
production code must exist in the archive own vendor/ tree.

.gitattributes carried "vendor/ export-ignore" with an explicit warning
to remove it the moment production code imported a third-party package.
That happened when llmgateway.go took on oss-telemetry for anonymous
usage reporting, and the warning was missed. The tag itself always had
vendor/; git archive stripped it, so the tarball shipped a go.mod
requiring a module whose source was absent.

Verified by reproducing the analyzer: the v1.0.43 archive contains 0
vendor entries, the fixed archive contains 71, and interpreting the
extracted archive under yaegi passes.
---
 .gitattributes | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 874572b..e71100a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,18 +3,30 @@
 # (.goreleaser.yaml), so these entries are the actual filter for the
 # release source tarball — not the archive block's own file globs, which
 # have no negation syntax and cannot exclude anything.
-# WARNING (v0.2 final review wave, 2026-08-20): vendor/ is safe to
-# export-ignore ONLY because every current go.mod dependency
-# (github.com/stretchr/testify, its go.yaml.in/yaml/v3 indirect) is a
-# TEST-only dependency, imported solely by *_test.go files — which are
-# themselves export-ignored below, so the released tarball never contains
-# code that imports them and never needs vendor/ to build. go.mod itself
-# is NOT export-ignored and ships in every release tarball as-is. The
-# moment any non-test .go file (production code, not *_test.go) imports a
-# third-party package, this line MUST be removed: otherwise the tarball
-# ships a go.mod requiring a module its own vendor/ was stripped out of,
-# and the extracted source cannot build standalone.
-vendor/ export-ignore
+# vendor/ is deliberately NOT export-ignored, and must stay that way.
+#
+# It WAS export-ignored until 2026-08-23, on the reasoning that every
+# dependency was test-only (github.com/stretchr/testify and its
+# go.yaml.in/yaml/v3 indirect), imported solely by *_test.go files that
+# are themselves export-ignored below — so the tarball never contained
+# code needing vendor/ to build. That comment carried an explicit warning
+# to remove the line the moment production code imported a third-party
+# package.
+#
+# That happened, and the warning was missed: llmgateway.go took on
+# github.com/lukaszraczylo/oss-telemetry as a RUNTIME dependency. The
+# release tarball then shipped a go.mod requiring a module whose source
+# had been stripped, and the Traefik Plugin Catalog analyzer (piceus)
+# rejected v1.0.43 with:
+#
+#   import "github.com/lukaszraczylo/oss-telemetry" error:
+#   unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"
+#
+# piceus fetches the source ARCHIVE at the released tag and interprets it
+# with Yaegi. It never runs `go mod download`, so every non-stdlib import
+# in production code must be present in the archive's own vendor/ tree.
+# Shipping vendor/ also costs the test-only deps a few hundred KB in the
+# tarball, which is the correct trade against being unimportable.
 integration/ export-ignore
 tools/ export-ignore
 docs/ export-ignore