license-check.yml

name: license-check

# Runs go-licenses against macontrol's full dependency graph and
# fails the build if any transitive dep declares a license that
# isn't on the allow-list. Sister gate to the per-PR
# dependency-review workflow (which only sees diffs): this one
# runs on every push so master always reflects a clean license
# posture across the whole graph.
#
# Allow-list: permissive licenses compatible with macontrol's
# MIT distribution. Anything else (GPL, AGPL, proprietary,
# unknown) trips the build.

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: go-licenses
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Install go-licenses
        # Pinned to the latest v1 release. v2.x renamed the module
        # path to github.com/google/go-licenses/v2 — a separate
        # migration when we get there.
        run: go install github.com/google/go-licenses@v1.6.0

      - name: Allow-list check
        # `check` exits non-zero if any dep falls outside the
        # allow-list. The allow-list is the standard permissive
        # set; macontrol's current graph (go-telegram/bot,
        # lumberjack, x/term, x/sys) is entirely MIT + BSD-3
        # so this lands green on day one.
        run: |
          set -euo pipefail
          go-licenses check ./... \
            --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0,Unlicense