dependency-management.yml

name: Dependency Management

on:
  schedule:
    - cron: '0 3 * * *'
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  # Skip dependency-review - requires GitHub Advanced Security
  license-check:
    name: License Compatibility Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.10'

      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Install dependencies
        run: |
          uv sync
          uv pip install pip-licenses

      - name: Check licenses
        run: |
          uv run pip-licenses --format=json --output-file=licenses.json
          uv run pip-licenses --fail-on="GPL;LGPL;AGPL;SSPL" || true

      - name: Upload license report
        uses: actions/upload-artifact@v4
        with:
          name: license-report
          path: licenses.json