ci: replace the license workflow with a read-only advisory check

The license bot service (Dcntrlized/license-bot) is authoritative: it amends
missing AGPL headers into the PR head commit, including for fork PRs, and
reports the license-bot / addlicense commit status. This workflow now only
reports an honest advisory signal, holds no secrets and never writes.

.gitea/workflows/license.yml

@@ -1,25 +1,22 @@
 name: license-headers
 
-# Enforce AGPL-3.0 headers on every file ADDED by a pull request: amend the PR
+# Advisory license check.
-# head commit with the headers and comment the new commit hash on the PR.
 #
-# `runs-on` must match a registered runner label. The org's only runner offers
+# The Dcntrlized license bot (the webhook service in this repository) is the
-# `alpine-latest` (container `node:alpine`), so jobs asking for anything else
+# authority: it amends the missing AGPL headers into the pull request's head
-# (e.g. `alpine-3.24`) queue forever — that is why this bot never ran before.
+# commit and reports the `license-bot / addlicense` commit status. This workflow
-#
+# duplicates the check read-only so a pull request still shows an honest signal
-# No long-lived secret is needed or wanted here: Gitea mints a per-run token
+# when the bot is unavailable. It holds no secrets, never writes, and must not
-# (`secrets.GITHUB_TOKEN`) scoped to this repository, which is enough to amend
+# be made a required check: Gitea evaluates a pull request's workflows from the
-# the PR branch and comment. Never add a PAT/SSH key — an action that runs on
+# head branch, so any context this job reports can be reproduced by a
-# PRs (including forks) must stay keyless, and Gitea withholds repo/org secrets
+# contributor who edits the workflow.
-# from fork PRs anyway.
 
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
-  contents: write
+  contents: read
-  issues: write
   pull-requests: read
 
 concurrency:
@@ -32,143 +29,80 @@ defaults:
 
 jobs:
   addlicense:
+    name: addlicense
     runs-on: alpine-latest
     steps:
-      - name: Install prerequisites
+      - name: Prerequisites
         run: apk add --no-cache git curl ca-certificates jq
 
-      - name: Checkout pull request head branch
+      - name: Install addlicense
+        run: |
+          set -e
+          curl -fsSL -o /tmp/addlicense.tgz \
+            https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz
+          tar -xzf /tmp/addlicense.tgz -C /tmp
+          install -m 0755 /tmp/addlicense /usr/local/bin/addlicense
+
+      - name: Check added files for an AGPL header
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SERVER: ${{ gitea.server_url }}
+          REPO: ${{ gitea.repository }}
+          NUM: ${{ gitea.event.pull_request.number }}
+          HEAD_REPO: ${{ gitea.event.pull_request.head.repo.full_name }}
+          HEAD_REF: ${{ gitea.event.pull_request.head.ref }}
         run: |
           set -e
-          REF="${{ gitea.event.pull_request.head.ref }}"
-          HEAD_REPO="${{ gitea.event.pull_request.head.repo.full_name }}"
-          BASE_REPO="${{ gitea.repository }}"
-          if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
-            echo "Fork PR ($HEAD_REPO -> $BASE_REPO): the bot cannot push to a fork; skipping."
-            echo "fork_pr=true" >> "$GITHUB_ENV"
-            exit 0
-          fi
-          # Keep the scheme: the dev Gitea is HTTP-only, so a hardcoded https://
-          # here fails with "TLS connect error: wrong version number".
-          SERVER="${{ gitea.server_url }}"
-          SERVER="${SERVER%/}"
           SCHEME="${SERVER%%://*}"
           HOST="${SERVER#*://}"
-          git clone --depth 1 --branch "$REF" \
+          api() { curl -fsS -H "Authorization: token $TOKEN" "$@"; }
-            "${SCHEME}://oauth2:${TOKEN}@${HOST}/${BASE_REPO}.git" .
-          # Lease value for the later force push: the exact remote head we based on.
-          git ls-remote origin "refs/heads/${REF}" | cut -f1 > /tmp/head_before.txt
-          echo "checked out ${REF} at $(git rev-parse HEAD)"
 
-      - name: Install addlicense
+          # Every file this pull request added (paginated).
-        if: env.fork_pr != 'true'
-        run: |
-          set -e
-          curl -sSL -o /tmp/addlicense.tar.gz \
-            https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz
-          tar -xzf /tmp/addlicense.tar.gz -C /tmp
-
-      - name: Add AGPL-3.0 headers to newly added files
-        if: env.fork_pr != 'true'
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -e
-          SERVER="${{ gitea.server_url }}"
-          SERVER="${SERVER%/}"
-          REPO="${{ gitea.repository }}"
-          PR="${{ gitea.event.pull_request.number }}"
-
-          # Files added by this PR, straight from the API (no base history needed).
-          : > /tmp/added.txt
           page=1
-          while : ; do
+          : > /tmp/added.txt
-            body="$(curl -sS -H "Authorization: token ${TOKEN}" \
+          while :; do
-              "${SERVER}/api/v1/repos/${REPO}/pulls/${PR}/files?limit=100&page=${page}")"
+            batch="$(api "$SERVER/api/v1/repos/$REPO/pulls/$NUM/files?limit=50&page=$page")"
-            n="$(printf '%s' "$body" | jq 'length')"
+            printf '%s' "$batch" | jq -r '.[] | select(.status=="added") | .filename' >> /tmp/added.txt
-            [ "$n" = "0" ] && break
+            [ "$(printf '%s' "$batch" | jq 'length')" -lt 50 ] && break
-            printf '%s' "$body" | jq -r '.[] | select(.status=="added") | .filename' >> /tmp/added.txt
-            [ "$n" -lt 100 ] && break
             page=$((page + 1))
           done
 
-          # addlicense validates -ignore with doublestar and silently skips file
+          if [ ! -s /tmp/added.txt ]; then
-          # types it does not understand, so pass every added file and let
+            echo "This pull request adds no files; nothing to check."
-          # .licenseignore be the only escape hatch.
+            exit 0
-          set -- -v -f .license-header.tpl -c "Dcntrlized" -y "$(date +%Y)"
-          if [ -f .licenseignore ]; then
-            while IFS= read -r line; do
-              case "$line" in ""|\#*) continue ;; esac
-              set -- "$@" -ignore "$line"
-            done < .licenseignore
           fi
-          found=0
+
-          while IFS= read -r f; do
+          # The head may be a fork: the per-run token is read-only and can
-            [ -n "$f" ] || continue
+          # still clone it. The scheme comes from gitea.server_url because the
-            [ -f "$f" ] || continue
+          # instance may be plain HTTP.
-            found=1
+          git clone --quiet --depth 1 --branch "$HEAD_REF" \
-            /tmp/addlicense "$@" "$f"
+            "$SCHEME://oauth2:$TOKEN@$HOST/$HEAD_REPO.git" /tmp/pr
+          cd /tmp/pr
+
+          # .licenseignore holds doublestar globs, not prefixes.
+          set --
+          while IFS= read -r pattern; do
+            case "$pattern" in ''|\#*) continue ;; esac
+            set -- "$@" -ignore "$pattern"
+          done < .licenseignore
+
+          year="$(date +%Y)"
+          : > /tmp/missing.txt
+          while IFS= read -r file; do
+            [ -z "$file" ] && continue
+            [ -e "$file" ] || continue
+            if ! addlicense -check -f .license-header.tpl -c Dcntrlized -y "$year" "$@" "$file" >/dev/null 2>&1; then
+              printf '  - %s\n' "$file" >> /tmp/missing.txt
+            fi
           done < /tmp/added.txt
-          [ "$found" = "1" ] || echo "No newly added files."
 
-          if git diff --quiet; then
+          if [ -s /tmp/missing.txt ]; then
-            echo "no_changes=true" >> "$GITHUB_ENV"
+            echo "::error::This pull request adds files without an AGPL-3.0 header:"
-          else
+            cat /tmp/missing.txt
-            echo "no_changes=false" >> "$GITHUB_ENV"
+            echo ""
+            echo "The license bot normally amends these into your commit automatically."
+            echo "If it did not, copy the header from .license-header.tpl and push again."
+            exit 1
           fi
 
-      - name: Amend the commit and force-push
+          echo "All added files carry an AGPL-3.0 header."
-        if: env.fork_pr != 'true' && env.no_changes == 'false'
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -e
-          REF="${{ gitea.event.pull_request.head.ref }}"
-          SERVER="${{ gitea.server_url }}"
-          SERVER="${SERVER%/}"
-          SCHEME="${SERVER%%://*}"
-          HOST="${SERVER#*://}"
-          git config user.name "Dcntrlized Auto CopyLeft Bot"
-          git config user.email "[email protected]"
-          git add -A
-          git commit --amend --no-edit
-          SHA="$(git rev-parse HEAD)"
-          printf '%s\n' "$SHA" > /tmp/commit_sha.txt
-          echo "amended to $SHA"
-          BEFORE="$(cat /tmp/head_before.txt)"
-          git push --force-with-lease="refs/heads/${REF}:${BEFORE}" \
-            "${SCHEME}://oauth2:${TOKEN}@${HOST}/${{ gitea.repository }}.git" \
-            "HEAD:refs/heads/${REF}"
-
-      - name: Comment on the pull request
-        if: env.fork_pr != 'true' && env.no_changes == 'false'
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -e
-          SERVER="${{ gitea.server_url }}"
-          SERVER="${SERVER%/}"
-          REPO="${{ gitea.repository }}"
-          PR="${{ gitea.event.pull_request.number }}"
-          SHA="$(cat /tmp/commit_sha.txt)"
-          cat > /tmp/pr-comment.md <<EOF
-          ## Uh oh! Unlicensed code detected!
-
-          You just tried to push **unlicensed code**! This repository is covered by the
-          [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.html) license, and all code
-          requires a license header.
-
-          Thankfully, the bot caught it and amended your commit
-          ([\`${SHA}\`](${SERVER}/${REPO}/commit/${SHA})) with the correct licensing.
-
-          If this looks wrong, tag **@Admin** so we can take a look!
-          EOF
-          BODY="$(jq -n --rawfile b /tmp/pr-comment.md '{body:$b}')"
-          curl -sS -X POST \
-            "${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments" \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$BODY"
-          echo "comment posted"