From 44b97c90c4b97fedf77bf88753ebdb255464846a Mon Sep 17 00:00:00 2001
From: dongjiang <dongjiang1989@126.com>
Date: Fri, 28 Aug 2026 17:29:06 +0800
Subject: [PATCH] ci: add license compliance check to CI pipeline

- New license-check job diffs PR against base branch for dependency changes
- Fails CI when pyproject.toml changes but NOTICE or THIRD_PARTY_LICENSES.md not updated
- build job depends on license-check (failure blocks packaging)
- test job only depends on lint (license issues don't block tests)
- Push events skip the check early (no base_ref to diff against)

Signed-off-by: dongjiang <dongjiang1989@126.com>
---
 .github/workflows/check.yml | 55 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 002c885..125617b 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -52,7 +52,7 @@ jobs:
   build:
     name: Build package
     runs-on: ubuntu-latest
-    needs: lint
+    needs: [lint, license-check]
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
@@ -67,3 +67,56 @@ jobs:
         with:
           name: dist
           path: dist/
+
+  # ============ License Compliance ============
+  license-check:
+    name: License Compliance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Check NOTICE and THIRD_PARTY_LICENSES.md
+        run: |
+          BASE="origin/${{ github.base_ref }}"
+
+          # On push events there is no base_ref; nothing to diff against.
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "✅ Push event — license check skipped."
+            exit 0
+          fi
+
+          CHANGED=$(git diff --name-only "$BASE"...HEAD)
+
+          if echo "$CHANGED" | grep -q "pyproject.toml"; then
+            echo "::notice::pyproject.toml changed — verifying license files are updated"
+
+            NOTICE_OK=false
+            LICENSES_OK=false
+            FAILED=false
+
+            echo "$CHANGED" | grep -qx "NOTICE" && NOTICE_OK=true
+            echo "$CHANGED" | grep -qx "THIRD_PARTY_LICENSES.md" && LICENSES_OK=true
+
+            if [ "$LICENSES_OK" = false ]; then
+              echo "::error::pyproject.toml changed but THIRD_PARTY_LICENSES.md was not updated."
+              echo ""
+              echo "Please update THIRD_PARTY_LICENSES.md to reflect the dependency changes."
+              FAILED=true
+            fi
+
+            if [ "$NOTICE_OK" = false ]; then
+              echo "::error::pyproject.toml changed but NOTICE was not updated."
+              echo ""
+              echo "Please update NOTICE to reflect the dependency changes."
+              FAILED=true
+            fi
+
+            if [ "$FAILED" = true ]; then
+              exit 1
+            fi
+
+            echo "✅ License files updated alongside dependency changes."
+          else
+            echo "✅ No dependency changes — license check skipped."
+          fi