license-check.yml

# *******************************************************************************
# Copyright (c) 2025 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0
#
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************

name: License Check

on:
  workflow_call:
    inputs:
      repo-url:
        description: "Repository URL"
        required: false
        type: string
      bazel-target:
        description: "Custom Bazel target to run (e.g., 'run //:license-check')"
        required: false
        default: "run //:license-check"
        type: string
    secrets:
      dash-api-token:
        description: "Eclipse DASH API Token for license verification"
        required: true

jobs:
  license-check:
    runs-on: ${{ vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }}
    permissions:
      pull-requests: write
      issues: write
    steps:
      - name: Checkout repository (Handle all events)
        uses: actions/checkout@v4.2.2
        with:
          ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}

      - name: Setup Bazel with shared caching
        uses: eclipse-score/cicd-actions/setup-bazel-cache@setup-bazel-cache/v0.0.0
        with:
          unique-cache-name: ${{ github.workflow }}-${{ github.job }}

      - name: Run License Check via Bazel
        run: |
          set +e  # Allow execution to continue even if a command fails

          REPO_URL="${{ inputs.repo-url }}"
          if [[ -z "$REPO_URL" ]]; then
            REPO_URL="${{ github.server_url }}/${{ github.repository }}"
          fi

          OUTPUT=""
          EXIT_CODE=0

          # Use org secret as fallback if dash-api-token is not provided
          TOKEN="${{ secrets.dash-api-token }}"

          CMD="bazel ${{ inputs.bazel-target }} -- -review -project automotive.score -repo $REPO_URL -token $TOKEN"
          echo "Running: $CMD"

          CHECK_OUTPUT=$($CMD 2>&1)
          CHECK_EXIT_CODE=$?

          OUTPUT="[License Check Output]\n$CHECK_OUTPUT"
          if [ $CHECK_EXIT_CODE -ne 0 ]; then
            EXIT_CODE=$CHECK_EXIT_CODE
          fi

          echo -e "$OUTPUT" | tee license-check-output.txt
          echo "exit_code=$EXIT_CODE" >> $GITHUB_ENV
          echo "output<<EOF" >> $GITHUB_ENV
          echo -e "$OUTPUT" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Find Existing Comment
        if: github.event.pull_request
        uses: peter-evans/find-comment@v3
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: 'github-actions[bot]'
          body-includes: License Check Results

      - name: Comment on PR with License Check Results
        if: github.event.pull_request
        uses: peter-evans/create-or-update-comment@v4
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            ### License Check Results
            🚀 The **license check** job ran with the Bazel command:
            ```bash
            bazel ${{ inputs.bazel-target }}
            ```

            **Status:** ${{ env.exit_code == 0 && '✅ Passed' || '⚠️ Needs Review' }}

            <details>
            <summary>Click to expand output</summary>

            ```
            ${{ env.output }}
            ```

            </details>
          reactions: eyes
          edit-mode: replace