update_licenses.yaml

# Workflow to update licenses for Ubuntu, macOS Silicon and macOS intel
name: Update licenses
on:
  workflow_dispatch:
    inputs:
      linux:
        description: "Update licenses for Ubuntu"
        type: boolean
        required: false
        default: true
      mac_silicon:
        description: "Update licenses for macOS (silicon)"
        type: boolean
        required: false
        default: true
      mac_intel:
        description: "Update licenses for macOS (intel)"
        type: boolean
        required: false
        default: true

concurrency:
  group: "${{ github.ref }}-${{ github.event_name }}-${{ github.workflow }}"
  cancel-in-progress: true

jobs:
  # Update licenses for all selected OS
  # The matrix strategy trick is inspired from https://github.com/orgs/community/discussions/26253
  update_licenses:
    strategy:
      matrix:
        config:
          - os_name: linux
            os: ubuntu-latest 
          - os_name: mac_silicon
            os: macos-latest-xlarge
          - os_name: mac_intel
            os: macos-latest-large 
        triggerLinux:
          - ${{ inputs.linux }}
        triggerMacSilicon:
          - ${{ inputs.mac_silicon }}
        triggerMacIntel:
          - ${{ inputs.mac_intel }}
        exclude:
          - triggerLinux: false
            os_name: linux
          - triggerMacSilicon: false
            os_name: mac_silicon
          - triggerMacIntel: false
            os_name: mac_intel
        
      fail-fast: false
    
    runs-on: ${{ matrix.config.os }}
    defaults:
      run:
        shell: bash
    env:
      PIP_INDEX_URL: ${{ secrets.PIP_INDEX_URL }}
      PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}

    steps:
      # Mask internal URLs if logged
      - name: Add masks
        id: masks
        run: |
          echo "::add-mask::${{ secrets.INTERNAL_PYPI_URL_FOR_MASK }}"
          echo "::add-mask::${{ secrets.INTERNAL_REPO_URL_FOR_MASK }}"

      - name: Checkout Code
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
        with:
          token: ${{ secrets.BOT_TOKEN }}

      # Set up python 3.10 because Github does not seem to provide support for python 3.8 on arm64 
      # List of available versions and architectures : 
      # https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
      - name: Set up Python 3.10
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
        with:
          python-version: '3.10'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install poetry==1.7.1
          make setup_env

      - name: Update licenses
        run: |
          make licenses

      # Upload the updated license files as artifacts, if they exist
      # It is possible that no files have been generated if licenses have already been done for some
      # configuration(s)
      - uses: actions/upload-artifact@v4
        with:
          if-no-files-found: ignore
          name: licenses_${{ matrix.config.os_name }}
          path: |
            deps_licenses/licenses_${{ matrix.config.os_name }}_user.txt
            deps_licenses/licenses_${{ matrix.config.os_name }}_user.txt.md5

  # Push the updates license files, as a PR or directly to the branch
  push_licenses:
    runs-on: ubuntu-latest
    needs: [update_licenses]
    if: always()
    steps:
      # Mask internal URLs if logged
      - name: Add masks
        id: masks
        run: |
          echo "::add-mask::${{ secrets.INTERNAL_PYPI_URL_FOR_MASK }}"
          echo "::add-mask::${{ secrets.INTERNAL_REPO_URL_FOR_MASK }}"

      - name: Checkout Code
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
        with:
          token: ${{ secrets.BOT_TOKEN }}

      # Retrieve all updated license files
      # Enable merge multiple to download all files in the 'deps_licenses' directory
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: deps_licenses/
          merge-multiple: true

      # If the target branch is main or a release branch, a pull request is opened for everyone to 
      # review
      - name: Open PR
        if: ${{ github.ref_name == 'main' || startsWith(github.ref_name , 'release/') }} 
        uses: peter-evans/create-pull-request@c55203cfde3e5c11a452d352b4393e68b85b4533
        with:
          token: ${{ secrets.BOT_TOKEN }}
          commit-message: "chore: update licenses"
          branch: "chore/update_licenses"
          base: "${{ github.ref_name }}"
          title: "Update licenses in ${{ github.ref_name }}"
          body: "Update licenses in ${{ github.ref_name }}"

      # If the target branch is another branch, the current branch is automatically merged into it
      - name: Push changes into the current branch
        if: ${{ github.ref_name != 'main' && !(startsWith(github.ref_name , 'release/')) }}
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: "chore: update licenses"
          add_options: '-u'