git.stella-ops.org/.gitea/workflows/dependency-license-gate.yml

# Dependency License Compliance Gate
# Sprint: CI/CD Enhancement - Dependency Management Automation
#
# Purpose: Validate that all dependencies use approved licenses
# Triggers: PRs modifying package files

name: License Compliance

on:
  pull_request:
    paths:
      - 'src/Directory.Packages.props'
      - '**/package.json'
      - '**/package-lock.json'
      - '**/*.csproj'

env:
  DOTNET_VERSION: '10.0.100'
  # Blocked licenses (incompatible with AGPL-3.0)
  BLOCKED_LICENSES: 'GPL-2.0-only,SSPL-1.0,BUSL-1.1,Proprietary,Commercial'
  # Allowed licenses
  ALLOWED_LICENSES: 'MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,0BSD,Unlicense,CC0-1.0,LGPL-2.1,LGPL-3.0,MPL-2.0,AGPL-3.0,GPL-3.0'

jobs:
  check-nuget-licenses:
    name: NuGet License Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
          include-prerelease: true

      - name: Install dotnet-delice
        run: dotnet tool install --global dotnet-delice

      - name: Restore packages
        run: dotnet restore src/StellaOps.sln

      - name: Check NuGet licenses
        id: nuget-check
        run: |
          mkdir -p license-reports

          echo "Checking NuGet package licenses..."

          # Run delice on the solution
          dotnet delice src/StellaOps.sln \
            --output license-reports/nuget-licenses.json \
            --format json \
            2>&1 | tee license-reports/nuget-check.log || true

          # Check for blocked licenses
          BLOCKED_FOUND=0
          BLOCKED_PACKAGES=""

          IFS=',' read -ra BLOCKED_ARRAY <<< "$BLOCKED_LICENSES"
          for license in "${BLOCKED_ARRAY[@]}"; do
            if grep -qi "\"$license\"" license-reports/nuget-licenses.json 2>/dev/null; then
              BLOCKED_FOUND=1
              PACKAGES=$(grep -B5 "\"$license\"" license-reports/nuget-licenses.json | grep -o '"[^"]*"' | head -1 || echo "unknown")
              BLOCKED_PACKAGES="$BLOCKED_PACKAGES\n- $license: $PACKAGES"
            fi
          done

          if [[ $BLOCKED_FOUND -eq 1 ]]; then
            echo "::error::Blocked licenses found in NuGet packages:$BLOCKED_PACKAGES"
            echo "blocked=true" >> $GITHUB_OUTPUT
            echo "blocked_packages<<EOF" >> $GITHUB_OUTPUT
            echo -e "$BLOCKED_PACKAGES" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          else
            echo "All NuGet packages have approved licenses"
            echo "blocked=false" >> $GITHUB_OUTPUT
          fi

      - name: Upload NuGet license report
        uses: actions/upload-artifact@v4
        with:
          name: nuget-license-report
          path: license-reports/
          retention-days: 30

  check-npm-licenses:
    name: npm License Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Find package.json files
        id: find-packages
        run: |
          PACKAGES=$(find . -name "package.json" -not -path "*/node_modules/*" -not -path "*/bin/*" -not -path "*/obj/*" | head -10)
          echo "Found package.json files:"
          echo "$PACKAGES"
          echo "packages<<EOF" >> $GITHUB_OUTPUT
          echo "$PACKAGES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Install license-checker
        run: npm install -g license-checker

      - name: Check npm licenses
        id: npm-check
        run: |
          mkdir -p license-reports
          BLOCKED_FOUND=0
          BLOCKED_PACKAGES=""

          # Check each package.json directory
          while IFS= read -r pkg; do
            if [[ -z "$pkg" ]]; then continue; fi

            DIR=$(dirname "$pkg")
            echo "Checking $DIR..."

            cd "$DIR"
            if [[ -f "package-lock.json" ]] || [[ -f "yarn.lock" ]]; then
              npm install --ignore-scripts 2>/dev/null || true

              # Run license checker
              license-checker --json > "${GITHUB_WORKSPACE}/license-reports/npm-$(basename $DIR).json" 2>/dev/null || true

              # Check for blocked licenses
              IFS=',' read -ra BLOCKED_ARRAY <<< "$BLOCKED_LICENSES"
              for license in "${BLOCKED_ARRAY[@]}"; do
                if grep -qi "\"$license\"" "${GITHUB_WORKSPACE}/license-reports/npm-$(basename $DIR).json" 2>/dev/null; then
                  BLOCKED_FOUND=1
                  BLOCKED_PACKAGES="$BLOCKED_PACKAGES\n- $license in $DIR"
                fi
              done
            fi
            cd "$GITHUB_WORKSPACE"
          done <<< "${{ steps.find-packages.outputs.packages }}"

          if [[ $BLOCKED_FOUND -eq 1 ]]; then
            echo "::error::Blocked licenses found in npm packages:$BLOCKED_PACKAGES"
            echo "blocked=true" >> $GITHUB_OUTPUT
          else
            echo "All npm packages have approved licenses"
            echo "blocked=false" >> $GITHUB_OUTPUT
          fi

      - name: Upload npm license report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: npm-license-report
          path: license-reports/
          retention-days: 30

  gate:
    name: License Gate
    runs-on: ubuntu-latest
    needs: [check-nuget-licenses, check-npm-licenses]
    if: always()
    steps:
      - name: Check results
        run: |
          NUGET_BLOCKED="${{ needs.check-nuget-licenses.outputs.blocked }}"
          NPM_BLOCKED="${{ needs.check-npm-licenses.outputs.blocked }}"

          echo "## License Compliance Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY

          if [[ "$NUGET_BLOCKED" == "true" ]]; then
            echo "| NuGet | ❌ Blocked licenses found |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| NuGet | ✅ Approved |" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "$NPM_BLOCKED" == "true" ]]; then
            echo "| npm | ❌ Blocked licenses found |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| npm | ✅ Approved |" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "$NUGET_BLOCKED" == "true" ]] || [[ "$NPM_BLOCKED" == "true" ]]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### Blocked Licenses" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "The following licenses are not compatible with AGPL-3.0:" >> $GITHUB_STEP_SUMMARY
            echo "\`$BLOCKED_LICENSES\`" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Please replace the offending packages or request an exception." >> $GITHUB_STEP_SUMMARY

            echo "::error::License compliance check failed"
            exit 1
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "✅ All dependencies use approved licenses" >> $GITHUB_STEP_SUMMARY