update-3rdparty-licenses.yml

name: Update 3rd-party licenses

on:
  pull_request:
    paths:
      - "yarn.lock"

jobs:
  update-3rdparty-licenses:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
    steps:
      - name: Check out PR branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Check out dd-license-attribution
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: DataDog/dd-license-attribution
          ref: 224a89cb69d3143e8aa4640405037cf9c233ddf5
          path: dd-license-attribution

      - name: Install dd-license-attribution
        working-directory: dd-license-attribution
        run: |
          pip install .

      - name: Create mirrors.json for PR branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          cat > mirrors.json <<EOF
          [
            {
              "original_url": "${REPOSITORY_URL}",
              "mirror_url": "${REPOSITORY_URL}",
              "ref_mapping": {
                "branch:${DEFAULT_BRANCH}": "branch:${HEAD_REF}"
              }
            }
          ]
          EOF

      - name: Regenerate LICENSE-3rdparty.csv
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          dd-license-attribution generate-sbom-csv \
            --use-mirrors=mirrors.json \
            --no-scancode-strategy \
            --no-github-sbom-strategy \
            --yarn-subdir vendor \
            "${REPOSITORY_URL}" > LICENSE-3rdparty.csv

      - name: Append vendored dependencies from PR
        run: |
          cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv

      - name: Run LICENSE-3rdparty.csv update check
        env:
          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          BASE_REPO: ${{ github.repository }}
        run: |
          set -e

          if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
            echo "✅ LICENSE-3rdparty.csv is already up to date"
          else
            echo "📝 LICENSE-3rdparty.csv was modified by license attribution command"

            if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
              echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."

              git config --local user.email "action@github.com"
              git config --local user.name "GitHub Action"

              git add LICENSE-3rdparty.csv
              git commit -m "Update LICENSE-3rdparty.csv"

              git push origin HEAD:${GITHUB_HEAD_REF}

              echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"
            else
              echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
              echo ""
              echo "The license attribution command has modified LICENSE-3rdparty.csv."
              echo ""
              echo "To fix this issue:"
              echo "1. Set up dd-license-attribution locally by following the installation instructions in:"
              echo "   https://github.com/DataDog/dd-license-attribution"
              echo "2. Run the license CSV generation command locally:"
              echo "   dd-license-attribution generate-sbom-csv \\"
              echo "     --no-scancode-strategy \\"
              echo "     --no-github-sbom-strategy \\"
              echo "     https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
              echo "3. Append vendored dependencies:"
              echo "   cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
              echo "4. Commit the updated LICENSE-3rdparty.csv file"
              echo "5. Push your changes"
              echo ""
              echo "This helps keep the 3rd-party license information accurate."
              exit 1
            fi
          fi