action.yml

name: "foretop lading — licence obligation scan"
description: >-
  Checks dependency and model licences against policy and reports their review obligations.
author: "foretop"
branding:
  icon: "package"
  color: "blue"

inputs:
  path:
    description: "Path to scan, relative to the repository root."
    required: false
    default: "."
  policy:
    description: >-
      A built-in preset name (permissive-only, no-copyleft, no-field-of-use-restrictions) or a
      path (relative to `path`) to a YAML policy file. Defaults to permissive-only — unlike the
      bare CLI, where --policy is opt-in and omitting it means "always exit 0", a CI Action
      whose whole job is being a gate needs one active by default. Set to an empty string to
      disable the gate entirely (report-only, matching the CLI's own no-policy behaviour).
    required: false
    default: "permissive-only"
  scan-hf-cache:
    description: >-
      Also discover models/datasets in the runner's local Hugging Face cache. Off by default —
      a CI runner's ephemeral cache is rarely meaningful and scanning it is a real cost, not a
      free extra.
    required: false
    default: "false"
  sbom:
    description: >-
      Path to an existing CycloneDX 1.6 JSON SBOM (relative to `path`) to read additional
      pkg:pypi/... and pkg:huggingface/... artifacts from. Optional.
    required: false
    default: ""
  comment-on-pr:
    description: "Upsert a summary comment on the pull request (true/false)."
    required: false
    default: "true"
  github-token:
    description: "Token used to read/write the PR comment. Needs pull-requests: write."
    required: false
    default: ${{ github.token }}

outputs:
  exit-code:
    description: >-
      lading scan's own exit code: 0 nothing blocked (or no --policy), 1 a policy violation
      was found, 2 internal error (bad --policy, unreadable --sbom).
    value: ${{ steps.scan.outputs.exit-code }}

# Composite, not Docker or JS — same reasoning as every other Shape-A product's own action.yml
# in this suite: uvx already gives this a published, versioned artifact for free once
# foretop-lading ships to PyPI, so a container/build step would only duplicate that.
runs:
  using: "composite"
  steps:
    - name: Install uv
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

    - name: Scan and emit PR annotations
      id: scan
      shell: bash
      run: |
        set +e
        args=(scan "${{ inputs.path }}" --format annotations)
        if [ -n "${{ inputs.policy }}" ]; then
          args+=(--policy "${{ inputs.policy }}")
        fi
        if [ "${{ inputs.scan-hf-cache }}" = "true" ]; then
          args+=(--scan-hf-cache)
        fi
        if [ -n "${{ inputs.sbom }}" ]; then
          args+=(--sbom "${{ inputs.sbom }}")
        fi
        uvx foretop-lading==0.4.0 "${args[@]}"
        echo "exit-code=$?" >> "$GITHUB_OUTPUT"

    - name: Render PR comment body
      if: inputs.comment-on-pr == 'true' && github.event_name == 'pull_request'
      shell: bash
      run: |
        args=(scan "${{ inputs.path }}" --format markdown)
        if [ -n "${{ inputs.policy }}" ]; then
          args+=(--policy "${{ inputs.policy }}")
        fi
        if [ "${{ inputs.scan-hf-cache }}" = "true" ]; then
          args+=(--scan-hf-cache)
        fi
        if [ -n "${{ inputs.sbom }}" ]; then
          args+=(--sbom "${{ inputs.sbom }}")
        fi
        # The gate has already run in the previous step — --format markdown can itself exit 1
        # on the same violation, which would kill this step under `set -e` before the comment
        # is ever rendered. The exit code that actually fails the job is the earlier step's.
        set +e
        uvx foretop-lading==0.4.0 "${args[@]}" > lading-comment-body.md
        exit 0

    # Find-and-edit by an HTML marker, never post a second comment on repeat pushes — see
    # scripts/upsert_pr_comment.sh (ebb's own copy, root of the repo) for the same logic this
    # app's copy (scripts/upsert_pr_comment.sh, relative to this action) duplicates on purpose.
    - name: Upsert PR comment
      if: inputs.comment-on-pr == 'true' && github.event_name == 'pull_request'
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
        PR_NUMBER: ${{ github.event.pull_request.number }}
        COMMENT_BODY_FILE: lading-comment-body.md
        COMMENT_MARKER: "<!-- foretop:lading:pr-comment -->"
      run: ${{ github.action_path }}/scripts/upsert_pr_comment.sh

    # Exit codes are an API (specs/lading.md's own scan exit-code contract: 0/1/2 must never be
    # conflated). `set +e` in the scan step kept it alive through a policy violation so the
    # comment step still ran — this is what actually fails the check, once everything else has
    # had its turn.
    - name: Fail the check if a policy was violated or an error occurred
      if: steps.scan.outputs.exit-code != '0'
      shell: bash
      run: exit ${{ steps.scan.outputs.exit-code }}