license-check.yml

name: License Compliance

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: pip install -e ".[dev,redis,a2a]" pip-licenses

      - name: Check license compatibility
        run: |
          echo "=== Dependency Licenses ==="
          pip-licenses --format=table --with-urls || true

          echo ""
          echo "=== Checking for incompatible licenses ==="
          pip-licenses --format=json --output-file=licenses.json || true
          python -c "
          import json, sys, os

          if not os.path.exists('licenses.json') or os.path.getsize('licenses.json') == 0:
              print('WARNING: Could not generate license report')
              sys.exit(0)

          with open('licenses.json') as f:
              licenses = json.load(f)

          blocked_patterns = ['gpl-3.0', 'agpl-3.0', 'sspl-1.0']
          found = []
          for pkg in licenses:
              lic = pkg.get('License', '') or ''
              for b in blocked_patterns:
                  if b in lic.lower():
                      found.append(f\"  {pkg.get('Name', '?')} ({lic})\")
          if found:
              print('FAIL: Found incompatible licenses:')
              for f in found:
                  print(f)
              sys.exit(1)
          print(f'OK: All {len(licenses)} dependency licenses are compatible with Apache 2.0')
          "