Preserve prerelease suffixes when normalizing GitHub tags

src/fetchcode/package_util.py

@@ -119,10 +119,12 @@ def _get_github_packages(purl, version_regex, ignored_tag_regex, default_package
         else:
             version = tag
 
-        version = version.strip("Vv").strip()
+        version = version.strip()
+        if version.startswith(("v", "V")):
+            version = version[1:]
         if "+" in version:
-            first, last = version.split("+")
-            first.replace("_", ".")
+            first, last = version.split("+", 1)
+            first = first.replace("_", ".")
             version = f"{first}+{last}"
         else:
             version = version.replace("_", ".")

tests/data/package/github/openssl-expected.json

@@ -3099,7 +3099,7 @@
         "type": "openssl",
         "namespace": null,
         "name": "openssl",
-        "version": "0.9.8",
+        "version": "0.9.8v",
         "qualifiers": {},
         "subpath": null,
         "primary_language": "C",
@@ -3126,7 +3126,7 @@
         "dependencies": [],
         "contains_source_code": null,
         "source_packages": [],
-        "purl": "pkg:openssl/openssl@0.9.8",
+        "purl": "pkg:openssl/openssl@0.9.8v",
         "repository_homepage_url": null,
         "repository_download_url": null,
         "api_data_url": null
@@ -8499,7 +8499,7 @@
         "type": "openssl",
         "namespace": null,
         "name": "openssl",
-        "version": "1.1.1",
+        "version": "1.1.1v",
         "qualifiers": {},
         "subpath": null,
         "primary_language": "C",
@@ -8526,7 +8526,7 @@
         "dependencies": [],
         "contains_source_code": null,
         "source_packages": [],
-        "purl": "pkg:openssl/openssl@1.1.1",
+        "purl": "pkg:openssl/openssl@1.1.1v",
         "repository_homepage_url": null,
         "repository_download_url": null,
         "api_data_url": null
@@ -10295,4 +10295,4 @@
         "repository_download_url": null,
         "api_data_url": null
     }
-]
+]

tests/test_github_tag_versions.py

@@ -0,0 +1,47 @@
+# fetchcode is a free software tool from nexB Inc. and others.
+# Visit https://github.com/aboutcode-org/fetchcode for support and download.
+
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# http://nexb.com and http://aboutcode.org
+
+# This software is licensed under the Apache License version 2.0.
+
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at:
+# http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+import datetime
+
+import pytest
+from packageurl import PackageURL
+
+from fetchcode import package_util
+from fetchcode.packagedcode_models import Package
+
+
+@pytest.mark.parametrize(
+    "tag,expected",
+    [
+        ("v1.2-dev", "1.2-dev"),
+        ("v1_2_3+build_4", "1.2.3+build_4"),
+        ("v1_2+build+extra", "1.2+build+extra"),
+        ("vv1.2", None),
+    ],
+)
+def test_github_tag_version_normalization(monkeypatch, tag, expected):
+    monkeypatch.setattr(
+        package_util.utils,
+        "fetch_github_tags_gql",
+        lambda purl: [(tag, datetime.datetime(2026, 1, 1))],
+    )
+    purl = PackageURL("github", "example", "project")
+    packages = list(package_util.get_github_packages(purl, None, None, Package(**purl.to_dict())))
+    if expected is None:
+        assert packages == []
+        return
+    assert packages[0].version == expected
+    assert packages[0].download_url.endswith(f"/{tag}.tar.gz")