name: License Check

on:
  pull_request:
    types: [opened, synchronize, ready_for_review]
    branches: ["main"]
    paths:
      - "pyproject.toml"
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "mcp-servers/rust/**"
      - "package.json"
      - "package-lock.json"
      - "license-policy.toml"
      - "scripts/license_checker.py"
      - ".github/workflows/license-check.yml"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  license-check:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Install pip-licenses
        run: pip install pip-licenses

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "stable"

      - name: Install go-licenses
        run: go install github.com/google/go-licenses@latest

      - name: Install Rust stable
        run: rustup default stable

      - name: Install cargo-license
        run: cargo install cargo-license

      - name: Run license checker
        run: |
          python scripts/license_checker.py \
            --config license-policy.toml \
            --report-json license-check-report.json

      - name: Upload license report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: license-check-report
          path: license-check-report.json
