v2.1.0 Release Cannot Be Installed via `go install` Due to Module Path Mismatch

[Shion1305]

Describe the bug

The v2.1.0 release cannot be installed using go install because the module path in go.mod does not include the required /v2 suffix for v2+ modules as per Go's semantic import versioning rules.

Steps to Reproduce

go install github.com/slsa-framework/slsa-github-generator@v2.1.0

Error:

go: github.com/slsa-framework/slsa-github-generator@v2.1.0: 
  invalid version: module contains a go.mod file, so module path must match 
  major version ("github.com/slsa-framework/slsa-github-generator/v2")

Attempting with the /v2 suffix also fails:

go install github.com/slsa-framework/slsa-github-generator/v2@v2.1.0

Error:

go: github.com/slsa-framework/slsa-github-generator/v2@v2.1.0: 
  github.com/slsa-framework/slsa-github-generator@v2.1.0: 
  invalid version: module contains a go.mod file, so module path must match 
  major version ("github.com/slsa-framework/slsa-github-generator/v2")

Root Cause

The go.mod file in the v2.1.0 release specifies:

module github.com/slsa-framework/slsa-github-generator

However, according to Go's semantic import versioning, modules with major version v2 or higher must include the major version in the module path. For v2.x.x releases, the module path should be:

module github.com/slsa-framework/slsa-github-generator/v2

Required Changes

To fix this issue:

1. Update go.mod to change the module path:

   module github.com/slsa-framework/slsa-github-generator/v2

2. Update all import statements throughout the codebase to use the /v2 suffix:

   // Before
   import "github.com/slsa-framework/slsa-github-generator/..."
   
   // After
   import "github.com/slsa-framework/slsa-github-generator/v2/..."

3. Re-release as either:

   • Delete the v2.1.0 tag and re-release it with the fix, OR
   • Release a new v2.1.1 with the corrected module path

References

• Go Modules: Major Version Suffixes
• Go Wiki: Modules - Releasing Modules (v2 or Higher)