# This job runs containerd shared project-checks, that verifies licenses, headers, and commits.
# To run locally, you may just use `make lint` instead, that does the same thing
# (albeit `make lint` uses more modern versions).
name: job-lint-project

on:
  workflow_call:
    inputs:
      timeout:
        required: true
        type: number
      go-version:
        required: true
        type: string
      runner:
        required: true
        type: string

env:
  GOTOOLCHAIN: local

jobs:
  project:
    name: "commits, licenses..."
    timeout-minutes: ${{ inputs.timeout }}
    runs-on: ${{ inputs.runner }}
    defaults:
      run:
        shell: bash

    steps:
      - name: "Init: checkout"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 100
          path: src/github.com/containerd/nerdctl

      - name: "Init: install go"
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417  # v6.3.0
        with:
          go-version: ${{ inputs.go-version }}
          check-latest: true
          cache-dependency-path: src/github.com/containerd/nerdctl

      - name: "Run"
        uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4  # v1.2.2
        with:
          working-directory: src/github.com/containerd/nerdctl
          repo-access-token: ${{ secrets.GITHUB_TOKEN }}
          # go-licenses-ignore is set because go-licenses cannot detect the license of the following package:
          # * go-base36: Apache-2.0 OR MIT (https://github.com/multiformats/go-base36/blob/master/LICENSE.md)
          # * filepath-securejoin: MPL-2.0 AND BSD-3-Clause, exceptionally approved by CNCF
          #   (https://github.com/cncf/foundation/issues/1154#issuecomment-3562385979)
          #
          # The list of the CNCF-approved licenses can be found here:
          # https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
          go-licenses-ignore: |
            github.com/multiformats/go-base36
            github.com/cyphar/filepath-securejoin
