dd-trace-js/.github/workflows/update-3rdparty-licenses.yml at 037eccc826f869c6f1d4627429a6aadb7aa710b6 · DataDog/dd-trace-js · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Update 3rd-party licenses

on:
  pull_request_target:
    branches:
      - master
    paths:
      - 'yarn.lock'

jobs:
  update-3rdparty-licenses:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    env:
      REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
    steps:
      - name: Check out PR branch
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Get GitHub token with appropriate permissions
        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
        id: octo-sts
        with:
          scope: DataDog
          policy: dd-trace-js-license-attribution-read

      - name: Set up Python
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: '3.14'

      - name: Check out dd-license-attribution
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          repository: watson/dd-license-attribution
          ref: 18b3d1cb2d17c500a14108891db2486f0f103826
          path: dd-license-attribution

      - name: Install dd-license-attribution
        working-directory: dd-license-attribution
        run: |
          pip install .

      - name: Create mirrors.json for PR branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          cat > mirrors.json <<EOF
          [
            {
              "original_url": "${REPOSITORY_URL}",
              "mirror_url": "${REPOSITORY_URL}",
              "ref_mapping": {
                "branch:${DEFAULT_BRANCH}": "branch:${HEAD_REF}"
              }
            }
          ]
          EOF

      - name: Regenerate LICENSE-3rdparty.csv
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: |
          dd-license-attribution generate-sbom-csv \
            --use-mirrors=mirrors.json \
            --no-scancode-strategy \
            --no-github-sbom-strategy \
            --yarn-subdir vendor \
            "${REPOSITORY_URL}" > LICENSE-3rdparty.csv

      - name: Append vendored dependencies
        run: |
          cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv

      - name: Run LICENSE-3rdparty.csv update check
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
        run: ./.github/scripts/update-3rdparty-licenses.sh