update-3rdparty-licenses.yml

name: Update 3rd-party licenses

# `dd-license-attribution` does not yet read `bun.lock`; the project ships only
# `bun.lock` at the root, so the upstream auto-update tool drops every root
# runtime/optional dep on each run. `scripts/generate-3rdparty-licenses.js`
# regenerates `LICENSE-3rdparty.csv` from `bun.lock`,
# `vendor/bun.lock`, `.github/vendored-dependencies.csv`, and the npm
# registry instead. `scripts/check_licenses.js` (run via `npm run lint`)
# enforces row-level completeness on every PR; this workflow auto-commits the
# regenerated file for bot PRs and surfaces a clear error otherwise.

on:
  pull_request:
    paths:
      - ".github/vendored-dependencies.csv"
      - ".github/workflows/update-3rdparty-licenses.yml"
      - "LICENSE-3rdparty.csv"
      - "bun.lock"
      - "bunfig.toml"
      - "package.json"
      - "scripts/generate-3rdparty-licenses.js"
      - "scripts/helpers/concurrency.js"
      - "scripts/third-party-dependencies.js"
      - "vendor/bun.lock"
      - "vendor/package.json"

jobs:
  check-licenses:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      needs_update: ${{ steps.check.outputs.needs_update }}
      is_bot_same_repo: ${{ steps.check.outputs.is_bot_same_repo }}
      is_release_proposal: ${{ steps.check.outputs.is_release_proposal }}
      head_oid: ${{ steps.check.outputs.head_oid }}
    steps:
      - name: Check out PR branch
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/node/latest

      - name: Install dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Regenerate LICENSE-3rdparty.csv
        run: node scripts/generate-3rdparty-licenses.js

      - name: Check for LICENSE-3rdparty.csv changes
        id: check
        env:
          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          BASE_REPO: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          set -e
          echo "head_oid=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"

          if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
            echo "✅ LICENSE-3rdparty.csv is already up to date"
            echo "needs_update=false" >> "$GITHUB_OUTPUT"
          else
            echo "📝 LICENSE-3rdparty.csv was modified by the regen script"
            echo "needs_update=true" >> "$GITHUB_OUTPUT"
          fi

          if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
            echo "is_bot_same_repo=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_bot_same_repo=false" >> "$GITHUB_OUTPUT"
          fi

          # Release tooling requires the version bump to stay at HEAD.
          if [[ "$HEAD_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-proposal$ ]]; then
            echo "is_release_proposal=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_release_proposal=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload updated LICENSE-3rdparty.csv
        if: >-
          steps.check.outputs.needs_update == 'true' &&
          steps.check.outputs.is_bot_same_repo == 'true' &&
          steps.check.outputs.is_release_proposal != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: license-csv
          path: LICENSE-3rdparty.csv
          if-no-files-found: error

      - name: Fail for PRs with outdated licenses
        if: >-
          steps.check.outputs.needs_update == 'true' &&
          (steps.check.outputs.is_bot_same_repo != 'true' || steps.check.outputs.is_release_proposal == 'true')
        run: |
          echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
          echo ""
          echo "Run 'node scripts/generate-3rdparty-licenses.js' locally and commit the result."
          exit 1

  auto-commit-licenses:
    needs: check-licenses
    if: >-
      needs.check-licenses.outputs.needs_update == 'true' &&
      needs.check-licenses.outputs.is_bot_same_repo == 'true' &&
      needs.check-licenses.outputs.is_release_proposal != 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Mint GitHub App token (octo-sts)
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/dd-trace-js
          policy: update-3rdparty-licenses

      - name: Download updated LICENSE-3rdparty.csv
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: license-csv

      - name: Commit LICENSE-3rdparty.csv via GitHub API
        env:
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          EXPECTED_HEAD_OID: ${{ needs.check-licenses.outputs.head_oid }}
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: |
          set -e

          echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."

          # gh's `-f variables=<json>` does not parse the value as JSON; build
          # the `{query, variables}` body with jq and pipe via `--input -`.
          jq -nc \
            --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "$GITHUB_HEAD_REF" \
            --arg msg "Update LICENSE-3rdparty.csv" \
            --arg expected "$EXPECTED_HEAD_OID" \
            --arg path "LICENSE-3rdparty.csv" \
            --arg contents "$(base64 -w 0 LICENSE-3rdparty.csv)" \
            '{
              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }",
              variables: { input: {
                branch: { repositoryNameWithOwner: $repo, branchName: $branch },
                message: { headline: $msg },
                expectedHeadOid: $expected,
                fileChanges: { additions: [{ path: $path, contents: $contents }] }
              } }
            }' | gh api graphql --input - -q '.data.createCommitOnBranch.commit.url' >/dev/null

          echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"