name: License Check

on:
  workflow_call:

permissions:
  contents: read

jobs:
  license-check:
    name: License Check
    runs-on: ubuntu-slim
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6

      - name: Use mise to install dependencies
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          version: 2026.5.12
        env:
          # Required for GitHub-hosted tool downloads defined in mise.toml.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: go-cache-paths
        run: |
          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"

      - name: Go Mod Cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-license-check-go-mod-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-license-check-go-mod-

      # `licensei cache` queries GitHub's API for every dep; cache the result.
      - name: Licensei Cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
        with:
          path: .licensei.cache
          key: ${{ runner.os }}-licensei-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-licensei-

      - name: Run License Check
        run: |
          set -o pipefail
          make license-check | tee license-check.log
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload License Check Report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: license-check-report
          path: license-check.log
