Alright, I think I have found the issue. https://go.dev/ref/mod says:
If a module is defined in a subdirectory within the repository, that is, the module subdirectory portion of the module path is not empty, then each tag name must be prefixed with the module subdirectory, followed by a slash. For example, the module golang.org/x/tools/gopls is defined in the gopls subdirectory of the repository with root path golang.org/x/tools. The version v0.4.0 of that module must have the tag named gopls/v0.4.0 in that repository.
Right now the importer code assumes that either we have a pseudo version (and thus can extract a raw commit hash) or else that the tag will be exactly (string-append "v" version) but this does not take into account the rule about subdirectory packages.
signature.asc
Description: PGP signature
