name: license-headers

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: write
  issues: write

defaults:
  run:
    shell: sh

jobs:
  addlicense:
    runs-on: alpine-3.24
    steps:
      - name: Install prerequisites
        run: apk add --no-cache git curl ca-certificates jq

      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
          SERVER="${{ gitea.server_url }}"
          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
          git clone --depth 1 --branch "$REF" \
            "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git" .

      - name: Install addlicense
        run: |
          set -e
          curl -sSL -o /tmp/addlicense.tar.gz \
            https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz
          tar -xzf /tmp/addlicense.tar.gz -C /tmp

      - name: Add AGPL-3.0 headers
        run: |
          /tmp/addlicense \
            -f .license-header.tpl \
            -c "Dcntrlized" \
            -y "$(date +%Y)" \
            -ignore "node_modules/**" \
            -ignore ".agents/**" \
            -ignore ".impeccable/**" \
            -ignore ".vscode/**" \
            -ignore "src/frontend/src/components/ui/**" \
            -ignore "**/*.md" \
            -ignore "**/*.json" \
            -ignore "**/*.yaml" \
            -ignore "**/*.yml" \
            -ignore "**/*.lock" \
            -ignore "**/*.sum" \
            .

      - name: Commit and push changes
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
          SERVER="${{ gitea.server_url }}"
          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
          if git diff --quiet; then
            echo "no_changes=true" >> "$GITHUB_ENV"
            echo "commit_sha=" >> "$GITHUB_ENV"
            echo "No license header changes."
            exit 0
          fi
          git config user.name "Dcntrlized Auto CopyLeft Bot"
          git config user.email "copyleft+bot@dcntrlized.org"
          git remote set-url origin "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git"
          git add -A
          git commit -m "chore: add AGPL-3.0 license headers"
          SHA="$(git rev-parse HEAD)"
          git push origin HEAD:refs/heads/$REF
          echo "no_changes=false" >> "$GITHUB_ENV"
          echo "commit_sha=$SHA" >> "$GITHUB_ENV"

      - name: Comment on pull request
        if: gitea.event_name == 'pull_request' && env.no_changes == 'false'
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ gitea.event.pull_request.number }}
          COMMIT_SHA: ${{ env.commit_sha }}
          COMMIT_URL: "${{ gitea.server_url }}/${{ gitea.repository }}/commit/${{ env.commit_sha }}"
        run: |
          cat > /tmp/pr-comment.md <<'EOF'
          ## Uh oh! Unlicensed code detected!

          You just tried to push **unlicensed code**! This repository is covered by the
          [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.html) license, and all code
          requires a license header.

          Thankfully, our helpful bot just created a commit
          ([`COMMIT_SHA`](COMMIT_URL)) with the correct licensing!

          If you think this is incorrect, tag **@Admin** so we can take a look!
          EOF
          sed -i "s|COMMIT_SHA|${COMMIT_SHA}|g; s|COMMIT_URL|${COMMIT_URL}|g" /tmp/pr-comment.md
          BODY="$(jq -n --rawfile b /tmp/pr-comment.md '{body:$b}')"
          SERVER="${{ gitea.server_url }}"
          curl -sS -X POST \
            "${SERVER}/api/v1/repos/${{ gitea.repository }}/issues/${PR_NUMBER}/comments" \
            -H "Authorization: token ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "$BODY"