Tool to find direct dependency uses of a Go module in all repos in a GitHub org

find-deps.py

#!/usr/bin/env python3
import json
import re
import subprocess
import sys

ORG = "rancher"
PKG = "github.com/ghodss/yaml"

# Matches active go.mod dependency declarations (e.g., "require foo v1" or "foo v1").
DEP_REGEX = re.compile(rf"^\s*(?:require\s+)?{re.escape(PKG)}\s+\S+")


def search_code() -> list[dict]:
    cmd = [
        "gh",
        "api",
        "--paginate",
        f"search/code?q=org:{ORG}+{PKG}+filename:go.mod&per_page=100",
        "--jq",
        ".items[]",
    ]
    res = subprocess.run(cmd, capture_output=True, text=True)
    if res.returncode != 0:
        sys.exit(f"Search failed: {res.stderr.strip()}")

    items = []
    for line in res.stdout.strip().splitlines():
        if line:
            items.append(json.loads(line))
    return items


def fetch_raw_content(repo: str, path: str) -> str:
    cmd = [
        "gh",
        "api",
        f"repos/{repo}/contents/{path}",
        "-H",
        "Accept: application/vnd.github.raw",
    ]
    res = subprocess.run(cmd, capture_output=True, text=True)
    return res.stdout if res.returncode == 0 else ""


def main():
    items = search_code()

    for item in items:
        repo = item["repository"]["full_name"]
        path = item["path"]
        html_url = item["html_url"]

        content = fetch_raw_content(repo, path)
        if not content:
            continue

        for line_num, line in enumerate(content.splitlines(), start=1):
            if "// indirect" in line:
                continue
            if DEP_REGEX.search(line):
                print(f"{html_url}#L{line_num}")


if __name__ == "__main__":
    main()