name: License Check

on:
  workflow_call:

permissions:
  contents: read

jobs:
  license-check:
    name: License Check
    runs-on: ubuntu-slim
    timeout-minutes: 15
    env:
      MISE_PROFILE: cicd

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Use mise to install dependencies
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          version: 2026.5.12
        env:
          # Required for GitHub-hosted tool downloads defined in mise.cicd.toml and mise.toml.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: go-cache-paths
        run: |
          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-license-check-go-mod-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-license-check-go-mod-

      # `licensei cache` queries GitHub's API for every dep; cache the result.
      - name: Licensei Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: .licensei.cache
          key: ${{ runner.os }}-licensei-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-licensei-

      - name: Run License Check
        run: |
          set -o pipefail
          make license-check | tee license-check.log
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload License Check Report
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: license-check-report
          path: license-check.log
