name: Check license headers
on:
  push:
    branches:
      - main
      - release/**
  pull_request:
    branches:
      - main
      - release/**
    paths:
      - rust/**
      - python/**
      - protos/**
permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Install license-header-checker
        env:
          # Pin to a specific release and download the asset directly from the
          # release CDN. This avoids the flaky dynamic "latest" tag lookup in the
          # upstream install.sh (it fetches the releases page and parses tag_name,
          # which intermittently returns empty and fails the job).
          LHC_VERSION: "1.5.0"
        run: |
          set -euo pipefail
          mkdir -p ./bin
          base="https://github.com/lluissm/license-header-checker/releases/download/v${LHC_VERSION}"
          asset="license-header-checker_${LHC_VERSION}_linux_amd64.tar.gz"
          curl -sfSL "${base}/${asset}" -o "/tmp/${asset}"
          curl -sfSL "${base}/checksums.txt" -o /tmp/lhc-checksums.txt
          # Verify the download against the release checksums before extracting so a
          # corrupted or tampered asset cannot be executed. This restores the
          # integrity check the upstream install.sh performed via hash_sha256_verify.
          (cd /tmp && sha256sum -c --ignore-missing lhc-checksums.txt)
          tar -xzf "/tmp/${asset}" -C ./bin license-header-checker
          rm -f "/tmp/${asset}" /tmp/lhc-checksums.txt
      - name: Check license headers (rust)
        run: ./bin/license-header-checker -a -v ./rust/license_header.txt rust rs && [[ -z `git status -s` ]]
      - name: Check license headers (python)
        run: ./bin/license-header-checker -a -v ./python/license_header.txt python py && [[ -z `git status -s` ]]
      - name: Check license headers (protos)
        run: ./bin/license-header-checker -a -v ./protos/license_header.txt protos proto && [[ -z `git status -s` ]]
      - name: Check license headers (java jni)
        run: ./bin/license-header-checker -a -v ./java/jni_license_header.txt java/lance-jni rs && [[ -z `git status -s` ]]
      - name: Check license headers (java core src)
        run: ./bin/license-header-checker -a -v ./java/license_header.txt java/src java && [[ -z `git status -s` ]]
