name: License Compliance

on:
  pull_request:
    paths:
      - "**/pyproject.toml"
      - ".github/workflows/license_compliance.yml"
  # Since we test PRs, there is no need to run the workflow at each
  # merge on `main`. Let's use a cron job instead.
  schedule:
    - cron: "0 0 * * *" # every day at midnight
env:
  PYTHON_VERSION: "3.10"

permissions:
  contents: read

jobs:
  license_check_direct:
    name: Direct dependencies only
    env:
      REQUIREMENTS_FILE: requirements_direct.txt
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "${{ env.PYTHON_VERSION }}"

      - name: Get direct dependencies
        run: |
          python -m pip install --upgrade pip
          pip install toml --uploaded-prior-to=P1D
          python .github/utils/pyproject_to_requirements.py pyproject.toml > ${{ env.REQUIREMENTS_FILE }}

      - name: Check Licenses
        id: license_check_report
        uses: pilosus/action-pip-license-checker@e909b0226ff49d3235c99c4585bc617f49fff16a # v3.1.0
        with:
          github-token: ${{ secrets.GH_ACCESS_TOKEN }}
          requirements: ${{ env.REQUIREMENTS_FILE }}
          fail: "Copyleft,Other,Error"
          # Exclusions in the vanilla distribution must be explicitly motivated
          # - tqdm is MLP but there are no better alternatives
          # - typing_extensions>=4.13.0 has a Python Software Foundation License 2.0 but pip-license-checker does not recognize it
          #   (https://github.com/pilosus/pip-license-checker/issues/143)
          exclude: "(?i)^(tqdm|typing_extensions).*"

      # We keep the license inventory on FOSSA
      - name: Send license report to Fossa
        uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
        continue-on-error: true # not critical
        with:
          api-key: ${{ secrets.FOSSA_LICENSE_SCAN_TOKEN }}

      - name: Print report
        if: ${{ always() }}
        run: echo "${{ steps.license_check_report.outputs.report }}"

      - name: Notify Slack on failure
        if: failure()
        uses: deepset-ai/notify-slack-action@a65def0c8bf91d6520286ab34280151c76a5a008 # v1.1.0
        with:
          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS }}