From c4b791e639f47a981a278b9dc84ac089531deff9 Mon Sep 17 00:00:00 2001
From: ApolloF <me@apollof.nl>
Date: Sun, 1 Nov 2026 13:22:40 +0100
Subject: [PATCH] CI: regenerate third-party notices instead of failing on a
 stale copy

---
 .github/workflows/build.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 228a772..030433b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -90,9 +90,16 @@ jobs:
         working-directory: frontend
         run: npm test
 
-      - name: Third-party notices up to date
-        # Fails when a dependency changed without regenerating the file.
-        run: go run ./tools/notices -check
+      - name: Third-party notices
+        # Regenerated so every build ships the notices of the dependencies it
+        # was built with. A stale committed copy (every Dependabot bump) is a
+        # warning: run go run ./tools/notices and commit the result.
+        run: |
+          go run ./tools/notices
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          if (git status --porcelain -- THIRD_PARTY_NOTICES.txt) {
+            echo "::warning::THIRD_PARTY_NOTICES.txt is out of date: run go run ./tools/notices and commit the result"
+          }
 
       - name: Sign
         if: env.SIGNPATH != 'true'