feat: add license bot workflow

2026-08-04 00:09:27 +01:00
parent e0c431960d
commit 413a0955ed
1 changed files with 107 additions and 0 deletions
@@ -0,0 +1,107 @@
+name: license-headers
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+permissions:
+  contents: write
+  issues: write
+
+jobs:
+  addlicense:
+    runs-on: alpine-3.24
+    steps:
+      - name: Install prerequisites
+        run: apk add --no-cache git curl ca-certificates jq
+
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
+          SERVER="${{ gitea.server_url }}"
+          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
+          git clone --depth 1 --branch "$REF" \
+            "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git" .
+
+      - name: Install addlicense
+        run: |
+          set -e
+          curl -sSL -o /tmp/addlicense.tar.gz \
+            https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz
+          tar -xzf /tmp/addlicense.tar.gz -C /tmp
+
+      - name: Add AGPL-3.0 headers
+        run: |
+          /tmp/addlicense \
+            -f .license-header.tpl \
+            -c "Dcntrlized" \
+            -y "$(date +%Y)" \
+            -ignore "node_modules/**" \
+            -ignore ".agents/**" \
+            -ignore ".impeccable/**" \
+            -ignore ".vscode/**" \
+            -ignore "src/frontend/src/components/ui/**" \
+            -ignore "**/*.md" \
+            -ignore "**/*.json" \
+            -ignore "**/*.yaml" \
+            -ignore "**/*.yml" \
+            -ignore "**/*.lock" \
+            -ignore "**/*.sum" \
+            .
+
+      - name: Commit and push changes
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
+          SERVER="${{ gitea.server_url }}"
+          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
+          if git diff --quiet; then
+            echo "no_changes=true" >> "$GITHUB_ENV"
+            echo "commit_sha=" >> "$GITHUB_ENV"
+            echo "No license header changes."
+            exit 0
+          fi
+          git config user.name "Dcntrlized Auto CopyLeft Bot"
+          git config user.email "[email protected]"
+          git remote set-url origin "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git"
+          git add -A
+          git commit -m "chore: add AGPL-3.0 license headers"
+          SHA="$(git rev-parse HEAD)"
+          git push origin HEAD:refs/heads/$REF
+          echo "no_changes=false" >> "$GITHUB_ENV"
+          echo "commit_sha=$SHA" >> "$GITHUB_ENV"
+
+      - name: Comment on pull request
+        if: gitea.event_name == 'pull_request' && env.no_changes == 'false'
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ gitea.event.pull_request.number }}
+          COMMIT_SHA: ${{ env.commit_sha }}
+          COMMIT_URL: "${{ gitea.server_url }}/${{ gitea.repository }}/commit/${{ env.commit_sha }}"
+        run: |
+          cat > /tmp/pr-comment.md <<'EOF'
+          ## Uh oh! Unlicensed code detected!
+
+          You just tried to push **unlicensed code**! This repository is covered by the
+          [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.html) license, and all code
+          requires a license header.
+
+          Thankfully, our helpful bot just created a commit
+          ([`COMMIT_SHA`](COMMIT_URL)) with the correct licensing!
+
+          If you think this is incorrect, tag **@Admin** so we can take a look!
+          EOF
+          sed -i "s|COMMIT_SHA|${COMMIT_SHA}|g; s|COMMIT_URL|${COMMIT_URL}|g" /tmp/pr-comment.md
+          BODY="$(jq -n --rawfile b /tmp/pr-comment.md '{body:$b}')"
+          SERVER="${{ gitea.server_url }}"
+          curl -sS -X POST \
+            "${SERVER}/api/v1/repos/${{ gitea.repository }}/issues/${PR_NUMBER}/comments" \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$BODY"