check-license-header.yml

name: Validate SPDX License Year and Company Mention in Currently Changed Files

on:
  pull_request:
    branches: [main]
    types:
      - opened
      - reopened
      - synchronize
      - assigned
      - review_requested

jobs:
  check-spdx-license:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set permissions for excluded paths file
        run: chmod +r excluded_paths.txt

      - name: Read excluded paths from file
        id: read-exclusions
        run: |
          excluded_paths=$(cat excluded_paths.txt | tr '\n' '|')
          echo "excluded_paths=$excluded_paths" >> $GITHUB_ENV

      - name: Identify currently changed files and check licenses
        id: check-licenses
        run: |
          current_year=$(date +"%Y")  # Dynamically set current year for checking
          echo "Current year: $current_year"
          echo "current_year=$current_year" >> $GITHUB_ENV  # Export current year to environment variables
          missing_license_files=""
          
          # Retrieve the excluded paths regex from environment variables
          excluded_paths_regex=${{ env.excluded_paths }}

          # Find changed Python files excluding the specified paths
          changed_files=$(git diff --name-only ${{ github.event.pull_request.base.sha }}...HEAD | grep '\.py$' | grep -Ev "$excluded_paths_regex" || true)
          echo "Changed files: $changed_files"

          for file in $changed_files; do
            # Check if file contains the correct SPDX license identifier and the exact copyright statement with dynamic current year
            if ! grep -q "SPDX-License-Identifier: Apache-2.0" "$file"; then
              echo "Missing SPDX-License-Identifier in file: $file"
            fi
            if ! grep -q "SPDX-FileCopyrightText: © $current_year Tenstorrent AI ULC" "$file"; then
              echo "Missing or incorrect SPDX-FileCopyrightText in file: $file"
            fi
            if ! grep -q "SPDX-License-Identifier: Apache-2.0" "$file" || ! grep -q "SPDX-FileCopyrightText: © $current_year Tenstorrent AI ULC" "$file"; then
              missing_license_files="${missing_license_files}${file}\n"
            fi
          done
          echo -e "Missing license files:\n$missing_license_files"
          echo "missing_license_files=$missing_license_files" >> $GITHUB_ENV
          echo "Checked files for correct SPDX-License compliance."

      - name: Comment on PR about incorrect SPDX licenses
        if: env.missing_license_files != ''
        uses: actions/github-script@v6
        with:
          script: |
            const issueNumber = context.issue.number;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const missingFiles = process.env.missing_license_files.trim().split('\\n').join('\n');
            const currentYear = process.env.current_year;
            const commentBody = `The following files are not compliant with the required licensing standards for ${currentYear} or do not contain the correct copyright text 'Tenstorrent AI ULC' within their license header:\n\`\`\`\n${missingFiles}\n\`\`\`\nPlease update the files accordingly. Your attention and cooperation in this matter are greatly appreciated.\nThank you.`;

            github.rest.issues.createComment({
              issue_number: issueNumber,
              owner: owner,
              repo: repo,
              body: commentBody
            });

      - name: Fail the workflow if license issues are found
        if: env.missing_license_files != ''
        run: |
          echo "Failing the workflow due to non-compliance with SPDX license requirements."
          exit 1