ci-oss-assets-validation.yaml

name: 'CI: OSS Assets Validation'

on:
  pull_request:
    branches-ignore: [wip/*, draft/*, temp/*]
  push:
    branches: [main, dev*]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      should-run: ${{ steps.changes.outputs.should-run }}
    steps:
      - uses: actions/checkout@v7
      - id: changes
        uses: ./.github/actions/changes-filter

  validate-fonts:
    needs: changes
    if: ${{ needs.changes.outputs.should-run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build project
        run: pnpm build
        env:
          DISTRIBUTION: localhost

      - name: Check for proprietary fonts in dist
        run: |
          set -euo pipefail
          echo '🔍 Checking dist for proprietary fonts...'

          if [ ! -d "dist" ] || [ -z "$(ls -A dist)" ]; then
            echo '❌ ERROR: dist/ directory missing or empty!'
            exit 1
          fi

          # Check for ABCROM and PP Formula font files
          if find dist/ -type f \( -iname '*abcrom*' -o -iname '*ppformula*' \) \
            \( -name '*.woff' -o -name '*.woff2' -o -name '*.ttf' -o -name '*.otf' \) \
            -print -quit | grep -q .; then
            echo ''
            echo '❌ ERROR: Found proprietary font files in dist!'
            echo ''
            find dist/ -type f \( -iname '*abcrom*' -o -iname '*ppformula*' \) \
              \( -name '*.woff' -o -name '*.woff2' -o -name '*.ttf' -o -name '*.otf' \)
            echo ''
            echo 'ABCROM and PP Formula fonts are proprietary and should not ship to OSS builds.'
            echo ''
            echo 'To fix this:'
            echo '1. Use conditional font loading based on isCloud'
            echo '2. Ensure fonts are dynamically imported, not bundled'
            echo '3. Check vite config for font handling'
            exit 1
          fi

          echo '✅ No proprietary fonts found in dist'

  validate-licenses:
    needs: changes
    if: ${{ needs.changes.outputs.should-run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate production dependency licenses
        run: |
          set -euo pipefail
          echo '🔍 Checking production dependency licenses...'

          # Use license-checker-rseidelsohn (actively maintained fork, handles monorepos)
          # Exclude internal @comfyorg packages from license check
          # Run in if condition to capture exit code
          if npx license-checker-rseidelsohn@4 \
            --production \
            --summary \
            --excludePackages '@comfyorg/comfyui-frontend;@comfyorg/design-system;@comfyorg/ingest-types;@comfyorg/registry-types;@comfyorg/shared-frontend-utils;@comfyorg/tailwind-utils;@comfyorg/comfyui-electron-types' \
            --clarificationsFile .github/license-clarifications.json \
            --onlyAllow 'MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Python-2.0;CC0-1.0;Unlicense;(MIT OR Apache-2.0);(MIT OR GPL-3.0);(Apache-2.0 OR MIT);(MPL-2.0 OR Apache-2.0);CC-BY-4.0;CC-BY-3.0;GPL-3.0-only'; then
            echo ''
            echo '✅ All production dependency licenses are approved!'
          else
            echo ''
            echo '❌ ERROR: Found dependencies with non-approved licenses!'
            echo ''
            echo 'To fix this:'
            echo '1. Check the license of the problematic package'
            echo '2. Find an alternative package with an approved license'
            echo '3. If the license is safe and OSI-approved, add it to the --onlyAllow list'
            echo ''
            echo 'For more info on OSI-approved licenses:'
            echo 'https://opensource.org/licenses'
            exit 1
          fi