[WIP] Create new branch for licensed workflow submissions

[Copilot]

Plan: Update Licensed Workflow to Create Branch and PR

• Analyze current licensed.yml workflow
• Update workflow to create licensed/update branch when running via workflow_dispatch
• Update workflow to push to the new branch instead of main
• Add step to create pull request using GitHub CLI
• Ensure workflow has necessary permissions for PR creation
• Address code review feedback (only add .licenses/ directory, handle no changes case)
• Implement force push to branch if PR already exists
• Run security checks - No alerts found

Original prompt

---

This section details on the original issue you should resolve

<issue_title>When running licensced workflow using workflow dispatch, create a new branch instead</issue_title>
<issue_description>Right now when running licensed, it tries to push directly to main, it shouldn't. Let it create a new branch called licensed/update instead and then submit a pull request.

https://github.com/jessehouwing/actions-dependency-submission/actions/runs/20027217823/job/57427284679</issue_description>

Comments on the Issue (you are @copilot in this section)

• FixesWhen running licensced workflow using workflow dispatch, create a new branch instead #46

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR updates the licensed workflow to create a branch and pull request instead of pushing directly to main when run via workflow_dispatch. This change improves the workflow by enabling proper code review of license updates before they are merged.

Key changes:

• Modified workflow to create a licensed/update branch for license updates
• Added automatic PR creation when license files change
• Implemented force push handling for existing branches

[Copilot]

The error message 'PR might already exist' is misleading. The gh pr create command will fail if a PR already exists, but the || echo suppresses the actual error and outputs a generic message. Consider using gh pr edit or checking for existing PRs first, or provide a more actionable error message that directs users to the existing PR.

Suggested change

	gh pr create \
	--title "Auto-update license files" \
	--body "Automated license cache update by Licensed tool." \
	--base main \
	--head licensed/update || echo "PR might already exist"
	# Check if a PR already exists for the branch
	existing_pr_url=$(gh pr list --head licensed/update --json url --jq '.[0].url')
	if [ -n "$existing_pr_url" ]; then
	echo "A pull request for 'licensed/update' already exists: $existing_pr_url"
	else
	gh pr create \
	--title "Auto-update license files" \
	--body "Automated license cache update by Licensed tool." \
	--base main \
	--head licensed/update
	fi

[Copilot]

[nitpick] The condition uses string comparison == 'true' for the has_changes output. While this works, GitHub Actions outputs are always strings. For consistency and clarity with the workflow's other conditionals, consider using the same pattern as line 59 which uses ${{... }} syntax more concisely.

Suggested change

	- if: |
	${{github.event_name == 'workflow_dispatch' &&
	steps.commit-licenses.outputs.has_changes == 'true' }}
	- if: ${{github.event_name == 'workflow_dispatch' && steps.commit-licenses.outputs.has_changes == 'true' }}