Merge pull request #56 from RI-SE/cursor/w2-eval-receipt #151

	# Dogfood: run the Curbpack composite Action against this repo.
	name: curbpack-dogfood

	on:
	pull_request:
	push:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read
	pull-requests: write
	security-events: write

	jobs:
	dogfood:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	with:
	go-version: "1.23.x"
	- name: Build workspace binary for Action
	run: \|
	mkdir -p bin
	go build -o bin/curbpack ./cmd/curbpack
	- name: Init house-policy if missing
	run: \|
	if [ ! -f .curbpack.json ]; then
	./bin/curbpack init --packs house-policy
	fi
	- name: Curbpack check (dogfood Action)
	uses: ./
	env:
	# Explicit RI-SE dogfood only — consumer Action path never source-builds
	# from a matching go.mod; see scripts/action-resolve-bin.sh.
	CURBPACK_ACTION_ALLOW_SOURCE_BUILD: "1"
	with:
	# Empty + allow flag → build from this checkout (never floating latest).
	version: ""
	heal: "true"
	prepare_release: "true"
	comment_on: red
	upload_sarif: "true"

Navigation Menu