name: license-headers

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: write
  issues: write

defaults:
  run:
    shell: sh

jobs:
  addlicense:
    runs-on: alpine-3.24
    steps:
      - name: Install prerequisites
        run: apk add --no-cache git curl ca-certificates jq

      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
          SERVER="${{ gitea.server_url }}"
          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
          git clone --depth 1 --branch "$REF" \
            "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git" .

      - name: Install addlicense
        run: |
          set -e
          curl -sSL -o /tmp/addlicense.tar.gz \
            https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz
          tar -xzf /tmp/addlicense.tar.gz -C /tmp

      - name: Add AGPL-3.0 headers
        run: |
          set -e
          set -- -f .license-header.tpl -c "Dcntrlized" -y "$(date +%Y)"
          while IFS= read -r line; do
            case "$line" in
              "" | \#*) continue ;;
            esac
            set -- "$@" -ignore "$line"
          done < .licenseignore
          /tmp/addlicense "$@" .

      - name: Commit and push changes
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          REF="${{ gitea.event.pull_request.head.ref || gitea.ref_name }}"
          SERVER="${{ gitea.server_url }}"
          SERVER="${SERVER#https://}"; SERVER="${SERVER#http://}"
          if git diff --quiet; then
            echo "no_changes=true" >> "$GITHUB_ENV"
            echo "commit_sha=" >> "$GITHUB_ENV"
            echo "No license header changes."
            exit 0
          fi
          git config user.name "Dcntrlized Auto CopyLeft Bot"
          git config user.email "copyleft+bot@dcntrlized.org"
          git remote set-url origin "https://oauth2:${TOKEN}@${SERVER}/${{ gitea.repository }}.git"
          git add -A
          git commit -m "chore: add AGPL-3.0 license headers"
          SHA="$(git rev-parse HEAD)"
          git push origin HEAD:refs/heads/$REF
          echo "no_changes=false" >> "$GITHUB_ENV"
          echo "commit_sha=$SHA" >> "$GITHUB_ENV"

      - name: Comment on pull request
        if: env.no_changes == 'false'
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COMMIT_SHA: ${{ env.commit_sha }}
          COMMIT_URL: "${{ gitea.server_url }}/${{ gitea.repository }}/commit/${{ env.commit_sha }}"
        run: |
          set -e
          SERVER="${{ gitea.server_url }}"
          REPO="${{ gitea.repository }}"
          if [ "${{ gitea.event_name }}" = "pull_request" ]; then
            PR_NUMBER="${{ gitea.event.pull_request.number }}"
          else
            OWNER="${REPO%%/*}"
            BRANCH="${{ gitea.ref_name }}"
            PR_NUMBER="$(curl -sS -H "Authorization: token ${TOKEN}" \
              "${SERVER}/api/v1/repos/${REPO}/pulls?state=open&limit=50" \
              | jq -r --arg b "$BRANCH" 'map(select(.head.ref == $b))[0].number // empty')"
            if [ -z "$PR_NUMBER" ]; then
              echo "No open pull request for branch ${BRANCH}; skipping comment."
              exit 0
            fi
          fi
          cat > /tmp/pr-comment.md <<'EOF'
          ## Uh oh! Unlicensed code detected!

          You just tried to push **unlicensed code**! This repository is covered by the
          [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.html) license, and all code
          requires a license header.

          Thankfully, our helpful bot just created a commit
          ([`COMMIT_SHA`](COMMIT_URL)) with the correct licensing!

          If you think this is incorrect, tag **@Admin** so we can take a look!
          EOF
          sed -i "s|COMMIT_SHA|${COMMIT_SHA}|g; s|COMMIT_URL|${COMMIT_URL}|g" /tmp/pr-comment.md
          BODY="$(jq -n --rawfile b /tmp/pr-comment.md '{body:$b}')"
          curl -sS -X POST \
            "${SERVER}/api/v1/repos/${REPO}/issues/${PR_NUMBER}/comments" \
            -H "Authorization: token ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "$BODY"