update-3rdparty-licenses.yml

name: Update 3rd-party licenses

on:
  pull_request:
    paths:
      - "yarn.lock"

jobs:
  update-3rdparty-licenses:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    env:
      REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
    steps:
      - name: Mint GitHub App token (octo-sts) for bot PR updates
        if: github.event.pull_request.user.type == 'Bot' && github.event_name == 'pull_request'
        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
        id: octo-sts
        with:
          scope: DataDog/dd-trace-js
          policy: update-3rdparty-licenses

      - name: Check out PR branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Check out dd-license-attribution
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: DataDog/dd-license-attribution
          ref: 224a89cb69d3143e8aa4640405037cf9c233ddf5
          path: dd-license-attribution

      - name: Install dd-license-attribution
        working-directory: dd-license-attribution
        run: |
          pip install .

      - name: Create mirrors.json for PR branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          cat > mirrors.json <<EOF
          [
            {
              "original_url": "${REPOSITORY_URL}",
              "mirror_url": "${REPOSITORY_URL}",
              "ref_mapping": {
                "branch:${DEFAULT_BRANCH}": "branch:${HEAD_REF}"
              }
            }
          ]
          EOF

      - name: Regenerate LICENSE-3rdparty.csv
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          dd-license-attribution generate-sbom-csv \
            --use-mirrors=mirrors.json \
            --no-scancode-strategy \
            --no-github-sbom-strategy \
            --yarn-subdir vendor \
            "${REPOSITORY_URL}" > LICENSE-3rdparty.csv

      - name: Append vendored dependencies from PR
        run: |
          cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv

      - name: Run LICENSE-3rdparty.csv update check
        env:
          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          BASE_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: |
          set -e

          if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
            echo "✅ LICENSE-3rdparty.csv is already up to date"
          else
            echo "📝 LICENSE-3rdparty.csv was modified by license attribution command"

            if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
              echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."

              expected_head_oid="$(git rev-parse HEAD)"
              contents="$(base64 -w 0 LICENSE-3rdparty.csv)"

              variables="$(jq -c \
                --arg repo "$GITHUB_REPOSITORY" \
                --arg branch "$GITHUB_HEAD_REF" \
                --arg msg "Update LICENSE-3rdparty.csv" \
                --arg expected "$expected_head_oid" \
                --arg path "LICENSE-3rdparty.csv" \
                --arg contents "$contents" \
                '{
                  input: {
                    branch: { repositoryNameWithOwner: $repo, branchName: $branch },
                    message: { headline: $msg },
                    expectedHeadOid: $expected,
                    fileChanges: { additions: [{ path: $path, contents: $contents }] }
                  }
                }'
              )"

              query='mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }'
              gh api graphql -f query="$query" -f variables="$variables" -q '.data.createCommitOnBranch.commit.url' >/dev/null

              echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"
            else
              echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
              echo ""
              echo "The license attribution command has modified LICENSE-3rdparty.csv."
              echo ""
              echo "To fix this issue:"
              echo "1. Set up dd-license-attribution locally by following the installation instructions in:"
              echo "   https://github.com/DataDog/dd-license-attribution"
              echo "2. Run the license CSV generation command locally:"
              echo "   dd-license-attribution generate-sbom-csv \\"
              echo "     --no-scancode-strategy \\"
              echo "     --no-github-sbom-strategy \\"
              echo "     https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
              echo "3. Append vendored dependencies:"
              echo "   cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
              echo "4. Commit the updated LICENSE-3rdparty.csv file"
              echo "5. Push your changes"
              echo ""
              echo "This helps keep the 3rd-party license information accurate."
              exit 1
            fi
          fi