update-3rdparty-licenses.yml

name: Update 3rd-party licenses

on:
  pull_request:
    paths:
      - ".github/vendored-dependencies.csv"
      - "vendor/package-lock.json"
      - "yarn.lock"

jobs:
  check-licenses:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    outputs:
      needs_update: ${{ steps.check.outputs.needs_update }}
      is_bot_same_repo: ${{ steps.check.outputs.is_bot_same_repo }}
      is_release_proposal: ${{ steps.check.outputs.is_release_proposal }}
      head_oid: ${{ steps.check.outputs.head_oid }}
    env:
      REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
    steps:
      - name: Get GitHub Token via dd-octo-sts
        id: generate-token
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        with:
          scope: DataDog/dd-trace-js
          policy: self.check-licenses

      - name: Check out PR branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"

      - name: Check out dd-license-attribution
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: watson/dd-license-attribution
          ref: 8ea483b9f735bf8da632c89796789cc2a050a9a6
          path: dd-license-attribution

      - name: Install dd-license-attribution
        working-directory: dd-license-attribution
        run: |
          pip install .

      - name: Create mirrors.json for PR branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          cat > mirrors.json <<EOF
          [
            {
              "original_url": "${REPOSITORY_URL}",
              "mirror_url": "${REPOSITORY_URL}",
              "ref_mapping": {
                "branch:${DEFAULT_BRANCH}": "branch:${HEAD_REF}"
              }
            }
          ]
          EOF

      - name: Regenerate LICENSE-3rdparty.csv
        env:
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          dd-license-attribution generate-sbom-csv \
            --use-mirrors=mirrors.json \
            --no-scancode-strategy \
            --no-github-sbom-strategy \
            --lockfile-subdir vendor \
            "${REPOSITORY_URL}" > LICENSE-3rdparty.csv

      - name: Append vendored dependencies from PR
        run: |
          cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv

      - name: Check for LICENSE-3rdparty.csv changes
        id: check
        env:
          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          BASE_REPO: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          set -e

          echo "head_oid=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"

          if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
            echo "✅ LICENSE-3rdparty.csv is already up to date"
            echo "needs_update=false" >> "$GITHUB_OUTPUT"
          else
            echo "📝 LICENSE-3rdparty.csv was modified by license attribution command"
            echo "needs_update=true" >> "$GITHUB_OUTPUT"
          fi

          if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
            echo "is_bot_same_repo=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_bot_same_repo=false" >> "$GITHUB_OUTPUT"
          fi

          # Release proposal branches are built by cherry-picking master onto a release
          # line and carry their own version-bump bookkeeping (scripts/release/proposal.js
          # assumes HEAD is always that bump commit). A commit landed here by this workflow
          # breaks that assumption, so these branches are excluded from auto-commit and
          # fail loudly instead — the license CSV is already correct on master and should
          # never need attribution work done directly on a proposal branch.
          if [[ "$HEAD_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-proposal$ ]]; then
            echo "is_release_proposal=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_release_proposal=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload updated LICENSE-3rdparty.csv
        if: >-
          steps.check.outputs.needs_update == 'true' &&
          steps.check.outputs.is_bot_same_repo == 'true' &&
          steps.check.outputs.is_release_proposal != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: license-csv
          path: LICENSE-3rdparty.csv
          if-no-files-found: error

      - name: Fail for PRs with outdated licenses
        if: >-
          steps.check.outputs.needs_update == 'true' &&
          (steps.check.outputs.is_bot_same_repo != 'true' || steps.check.outputs.is_release_proposal == 'true')
        run: |
          echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
          echo ""
          echo "The license attribution command has modified LICENSE-3rdparty.csv."
          echo ""
          echo "To fix this issue:"
          echo "1. Set up dd-license-attribution locally by following the installation instructions in:"
          echo "   https://github.com/DataDog/dd-license-attribution"
          echo "2. Run the license CSV generation command locally:"
          echo "   dd-license-attribution generate-sbom-csv \\"
          echo "     --no-scancode-strategy \\"
          echo "     --no-github-sbom-strategy \\"
          echo "     https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
          echo "3. Append vendored dependencies:"
          echo "   cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
          echo "4. Commit the updated LICENSE-3rdparty.csv file"
          echo "5. Push your changes"
          echo ""
          echo "This helps keep the 3rd-party license information accurate."
          exit 1

  auto-commit-licenses:
    needs: check-licenses
    if: >-
      needs.check-licenses.outputs.needs_update == 'true' &&
      needs.check-licenses.outputs.is_bot_same_repo == 'true' &&
      needs.check-licenses.outputs.is_release_proposal != 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Mint GitHub App token (octo-sts)
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/dd-trace-js
          policy: update-3rdparty-licenses

      - name: Download updated LICENSE-3rdparty.csv
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: license-csv

      - name: Commit LICENSE-3rdparty.csv via GitHub API
        env:
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          EXPECTED_HEAD_OID: ${{ needs.check-licenses.outputs.head_oid }}
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: |
          set -e

          echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."

          # gh's `-f variables=<json>` does not parse the value as JSON; build
          # the `{query, variables}` body with jq and pipe via `--input -`.
          jq -nc \
            --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "$GITHUB_HEAD_REF" \
            --arg msg "Update LICENSE-3rdparty.csv" \
            --arg expected "$EXPECTED_HEAD_OID" \
            --arg path "LICENSE-3rdparty.csv" \
            --arg contents "$(base64 -w 0 LICENSE-3rdparty.csv)" \
            '{
              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }",
              variables: { input: {
                branch: { repositoryNameWithOwner: $repo, branchName: $branch },
                message: { headline: $msg },
                expectedHeadOid: $expected,
                fileChanges: { additions: [{ path: $path, contents: $contents }] }
              } }
            }' | gh api graphql --input - -q '.data.createCommitOnBranch.commit.url' >/dev/null

          echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"