action.yml

name: 'Curbpack Check'
description: 'Run Curbpack evidence gates on a product repo (Linux/macOS Action runners only — not Windows runners). Prepares human-review evidence — not a conformity assessment.'
author: 'afelin'
branding:
  icon: 'shield'
  color: 'green'

inputs:
  version:
    description: 'Release tag to download (e.g. v0.5.2). Empty = download v0.5.2 (never floating latest). Source build only when RI-SE dogfood sets CURBPACK_ACTION_ALLOW_SOURCE_BUILD=1. Action = Linux/macOS only.'
    required: false
    default: ''
  packs:
    description: 'Optional comma-separated pack override for check (empty = .curbpack.json / house-policy default)'
    required: false
    default: ''
  diff:
    description: 'Delta mode — not release-gate safe. If true, pass --diff (only changed files; required-file gates still run). Default false for full-scan release gates.'
    required: false
    default: 'false'
  heal:
    description: 'If true, run check --heal (missing stubs only; never attest). Default false — opt in explicitly; generated scaffold remains red until replaced.'
    required: false
    default: 'false'
  prepare_release:
    description: 'If true, run prepare-release. On green uploads buyer-onepager; on red uploads curbpack-REMEDIATION-REVIEW only (not release sign-off).'
    required: false
    default: 'true'
  comment_pr:
    description: 'Deprecated — prefer comment_on. If false, never comment (overrides comment_on).'
    required: false
    default: 'true'
  comment_on:
    description: 'PR comment policy: red (default — only when gates fail or first sticky), always, never'
    required: false
    default: 'red'
  upload_sarif:
    description: 'If true, write and upload SARIF for gate failures (annotations in PR UI)'
    required: false
    default: 'true'
  working_directory:
    description: 'Product repo path (relative to workspace)'
    required: false
    default: '.'

outputs:
  score:
    description: 'Readiness score percent from Action Report / cache'
    value: ${{ steps.score.outputs.score }}
  passed:
    description: 'true if check exited 0'
    value: ${{ steps.run.outputs.passed }}

runs:
  using: composite
  steps:
    - name: Resolve curbpack binary
      id: bin
      shell: bash
      env:
        # Map Action inputs into env only. CURBPACK_ACTION_ALLOW_SOURCE_BUILD is
        # inherited from the caller workflow when set (dogfood); do not remap it
        # here or an empty composite env context would wipe the flag.
        CURBPACK_ACTION_VERSION: ${{ inputs.version }}
      run: |
        set -euo pipefail
        # Inputs arrive only via env (see env: above). Resolver lives in-repo so
        # scripts/action-resolve-test.sh exercises the same binary path.
        bash "${GITHUB_ACTION_PATH}/scripts/action-resolve-bin.sh"

    - name: Run curbpack check
      id: run
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      env:
        CURBPACK_ACTION_BIN: ${{ steps.bin.outputs.path }}
        CURBPACK_ACTION_PACKS: ${{ inputs.packs }}
        CURBPACK_ACTION_DIFF: ${{ inputs.diff }}
        CURBPACK_ACTION_HEAL: ${{ inputs.heal }}
      run: |
        set -euo pipefail
        BIN="${CURBPACK_ACTION_BIN:?}"
        PACKS="${CURBPACK_ACTION_PACKS:-}"
        DIFF="${CURBPACK_ACTION_DIFF:-false}"
        HEAL="${CURBPACK_ACTION_HEAL:-false}"
        case "$DIFF" in true|false) ;; *)
          echo "invalid inputs.diff (want true|false): ${DIFF}" >&2
          exit 1
          ;;
        esac
        case "$HEAL" in true|false) ;; *)
          echo "invalid inputs.heal (want true|false): ${HEAL}" >&2
          exit 1
          ;;
        esac
        EXTRA=()
        if [ -n "$PACKS" ]; then
          EXTRA+=(--packs "$PACKS")
        fi
        if [ "$DIFF" = "true" ]; then
          EXTRA+=(--diff)
        fi
        if [ "$HEAL" = "true" ]; then
          EXTRA+=(--heal)
        fi
        set +e
        "$BIN" check "${EXTRA[@]}" | tee /tmp/curbpack-check.txt
        CODE=${PIPESTATUS[0]}
        set -e
        if [ "$CODE" -eq 0 ]; then
          echo "passed=true" >> "$GITHUB_OUTPUT"
        else
          echo "passed=false" >> "$GITHUB_OUTPUT"
        fi
        if [ "$HEAL" = "true" ] && grep -qE 'applied [1-9][0-9]* missing stub|heal wrote missing stubs' /tmp/curbpack-check.txt; then
          echo "::warning::Heal wrote missing stubs; generated scaffold remains red until replaced with product-specific content."
          echo "HEAL STUBS WRITTEN — post-heal check result remains authoritative" >&2
        fi
        mkdir -p .github/curbpack/cache
        cp /tmp/curbpack-check.txt .github/curbpack/cache/ci-check-log.txt || true
        exit 0

    - name: Annotations + SARIF
      if: inputs.upload_sarif == 'true'
      id: sarif
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      env:
        CURBPACK_ACTION_BIN: ${{ steps.bin.outputs.path }}
      run: |
        set -euo pipefail
        BIN="${CURBPACK_ACTION_BIN:?}"
        OUT=".github/curbpack/cache/curbpack.sarif"
        mkdir -p .github/curbpack/cache
        # Prefer CLI SARIF (single Go source of truth); fall back to annotations-only if export missing.
        if "$BIN" export --sarif --out "$OUT" 2>/tmp/curbpack-sarif.err; then
          :
        else
          echo "export --sarif failed; writing empty SARIF shell" >&2
          cat /tmp/curbpack-sarif.err >&2 || true
          printf '%s\n' '{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"curbpack","informationUri":"https://github.com/RI-SE/curbpack","rules":[]}},"results":[]}]}' > "$OUT"
        fi
        # GitHub Actions annotations from latest_failure.json
        python3 <<'PY'
        import json, pathlib
        fail_path = pathlib.Path(".github/curbpack/cache/latest_failure.json")
        if not fail_path.exists():
            raise SystemExit(0)
        try:
            data = json.loads(fail_path.read_text())
        except Exception:
            raise SystemExit(0)
        for f in data.get("failures") or []:
            gate = f.get("gate_id") or "GATE"
            sev = (f.get("severity") or "warning").lower()
            level = "error" if sev in ("high", "critical") else "warning"
            desc = f.get("sanitized_description") or gate
            file = (f.get("ast_coordinates") or {}).get("target_file") or ""
            if file:
                print(f"::{level} file={file},line=1::{gate}: {desc}")
            else:
                print(f"::{level}::{gate}: {desc}")
        PY
        echo "path=.github/curbpack/cache/curbpack.sarif" >> "$GITHUB_OUTPUT"

    - name: Upload SARIF
      if: inputs.upload_sarif == 'true' && steps.run.outputs.passed != 'true'
      continue-on-error: true
      uses: github/codeql-action/upload-sarif@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
      with:
        sarif_file: ${{ inputs.working_directory }}/.github/curbpack/cache/curbpack.sarif
        category: curbpack

    - name: Prepare release artifacts
      if: inputs.prepare_release == 'true' && steps.run.outputs.passed == 'true'
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      env:
        CURBPACK_ACTION_BIN: ${{ steps.bin.outputs.path }}
        CURBPACK_ACTION_PACKS: ${{ inputs.packs }}
      run: |
        set -euo pipefail
        BIN="${CURBPACK_ACTION_BIN:?}"
        PACKS="${CURBPACK_ACTION_PACKS:-}"
        EXTRA=()
        if [ -n "$PACKS" ]; then
          EXTRA+=(--packs "$PACKS")
        fi
        "$BIN" prepare-release "${EXTRA[@]}"

    - name: Prepare remediation review pack (red only)
      if: inputs.prepare_release == 'true' && steps.run.outputs.passed != 'true'
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      env:
        CURBPACK_ACTION_BIN: ${{ steps.bin.outputs.path }}
        CURBPACK_ACTION_PACKS: ${{ inputs.packs }}
      run: |
        set -euo pipefail
        BIN="${CURBPACK_ACTION_BIN:?}"
        PACKS="${CURBPACK_ACTION_PACKS:-}"
        EXTRA=()
        if [ -n "$PACKS" ]; then
          EXTRA+=(--packs "$PACKS")
        fi
        echo "::warning::REMEDIATION REVIEW only — gates red; prepare-release output is not release sign-off"
        echo "REMEDIATION REVIEW only — gates red; not a release pack / not certification" >&2
        "$BIN" prepare-release "${EXTRA[@]}" || true
        echo "summary=REMEDIATION REVIEW only — gates failing; not release sign-off" >> "$GITHUB_STEP_SUMMARY" || true

    - name: Read score
      id: score
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      run: |
        set -euo pipefail
        SCORE="0"
        if [ -f .github/curbpack/cache/latest_failure.json ]; then
          SCORE=$(python3 -c 'import json;print(json.load(open(".github/curbpack/cache/latest_failure.json")).get("readiness_score",0))' 2>/dev/null || echo 0)
        elif [ -f .github/curbpack/cache/latest_action_report.md ]; then
          SCORE=$(sed -n 's/.*Readiness[^0-9]*\([0-9][0-9]*\).*/\1/p' .github/curbpack/cache/latest_action_report.md | head -n1)
          SCORE=${SCORE:-0}
        fi
        echo "score=${SCORE}" >> "$GITHUB_OUTPUT"

    - name: Upload buyer-onepager
      if: inputs.prepare_release == 'true' && steps.run.outputs.passed == 'true'
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: curbpack-buyer-onepager
        path: |
          ${{ inputs.working_directory }}/review-pack/buyer-onepager.html
          ${{ inputs.working_directory }}/.github/curbpack/cache/latest_action_report.md
          ${{ inputs.working_directory }}/.github/curbpack/cache/latest_failure.json
          ${{ inputs.working_directory }}/.github/curbpack/cache/curbpack.sarif
        if-no-files-found: warn

    - name: Upload REMEDIATION REVIEW pack
      if: inputs.prepare_release == 'true' && steps.run.outputs.passed != 'true'
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: curbpack-REMEDIATION-REVIEW
        path: |
          ${{ inputs.working_directory }}/review-pack/buyer-onepager.html
          ${{ inputs.working_directory }}/.github/curbpack/cache/latest_action_report.md
          ${{ inputs.working_directory }}/.github/curbpack/cache/latest_failure.json
          ${{ inputs.working_directory }}/.github/curbpack/cache/curbpack.sarif
        if-no-files-found: warn

    - name: Export ContextPack (fail soft on older pins)
      id: contextpack
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      env:
        CURBPACK_ACTION_BIN: ${{ steps.bin.outputs.path }}
        CURBPACK_ACTION_PACKS: ${{ inputs.packs }}
      run: |
        set -euo pipefail
        BIN="${CURBPACK_ACTION_BIN:?}"
        PACKS="${CURBPACK_ACTION_PACKS:-}"
        EXTRA=()
        if [ -n "$PACKS" ]; then
          EXTRA+=(--packs "$PACKS")
        fi
        mkdir -p .github/curbpack/cache
        set +e
        "$BIN" export --context-pack "${EXTRA[@]}" 2>/tmp/curbpack-context-pack.err
        CODE=$?
        set -e
        if [ "$CODE" -eq 0 ] && [ -f .github/curbpack/cache/context-pack.json ]; then
          echo "present=true" >> "$GITHUB_OUTPUT"
        else
          echo "present=false" >> "$GITHUB_OUTPUT"
          echo "context-pack export unavailable (older pin or export failure) — continuing" >&2
          cat /tmp/curbpack-context-pack.err >&2 || true
        fi

    - name: Upload ContextPack artifact
      if: steps.contextpack.outputs.present == 'true'
      continue-on-error: true
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: curbpack-context-pack
        path: |
          ${{ inputs.working_directory }}/.github/curbpack/cache/context-pack.json
          ${{ inputs.working_directory }}/.github/curbpack/cache/context-pack.md
        if-no-files-found: warn

    - name: PR sticky comment (red-only by default)
      if: inputs.comment_pr == 'true' && inputs.comment_on != 'never' && github.event_name == 'pull_request'
      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
      env:
        COMMENT_ON: ${{ inputs.comment_on }}
        CURBPACK_ACTION_WORKING_DIRECTORY: ${{ inputs.working_directory }}
        CURBPACK_ACTION_SCORE: ${{ steps.score.outputs.score }}
        CURBPACK_ACTION_PASSED: ${{ steps.run.outputs.passed }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const root = process.env.CURBPACK_ACTION_WORKING_DIRECTORY || '.';
          const score = process.env.CURBPACK_ACTION_SCORE || '0';
          const passed = process.env.CURBPACK_ACTION_PASSED === 'true';
          const mode = (process.env.COMMENT_ON || 'red').toLowerCase();
          const claim = 'Prepares evidence for human review — not a conformity assessment or certification.';

          const { data: comments } = await github.rest.issues.listComments({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
            per_page: 100,
          });
          const existing = comments.find(c => c.user.type === 'Bot' && c.body.includes('<!-- curbpack-sticky -->'));

          // Red-only: comment on fail, or first-run sticky; skip noisy green updates.
          if (mode === 'red' && passed && existing) {
            core.info('green + sticky exists — skip comment (zero babysitting)');
            return;
          }
          if (mode === 'red' && passed && !existing) {
            // First-run green: minimal check-mark, no essay.
            const body = [
              '<!-- curbpack-sticky -->',
              '## Curbpack check',
              '',
              `✅ Gates green — readiness **${score}%**`,
              '',
              `> ${claim}`,
            ].join('\n');
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            });
            return;
          }
          if (mode !== 'always' && mode !== 'red') {
            core.info(`unknown comment_on=${mode} — skipping`);
            return;
          }
          if (passed && mode === 'always') {
            // always + green: still keep it short
          }

          let report = '';
          const reportPath = path.join(root, '.github/curbpack/cache/latest_action_report.md');
          if (fs.existsSync(reportPath)) {
            report = fs.readFileSync(reportPath, 'utf8').trim();
            // Truncate to avoid leaking large doc excerpts into PR comments; prefer annotations/SARIF.
            const maxReport = 1200;
            if (report.length > maxReport) {
              report = report.slice(0, maxReport) + '\n\n_(truncated — see SARIF / annotations / latest_action_report.md)_';
            }
          }
          let fails = [];
          const failPath = path.join(root, '.github/curbpack/cache/latest_failure.json');
          if (fs.existsSync(failPath)) {
            try {
              const j = JSON.parse(fs.readFileSync(failPath, 'utf8'));
              fails = (j.failures || []).slice(0, 3).map(f => {
                const desc = String(f.sanitized_description || '').slice(0, 160);
                return `- \`${f.gate_id}\` (${f.severity}): ${desc}`;
              });
            } catch (_) {}
          }
          const barFilled = Math.max(0, Math.min(20, Math.floor(Number(score) / 5)));
          const thermo = '█'.repeat(barFilled) + '·'.repeat(20 - barFilled);
          const body = [
            '<!-- curbpack-sticky -->',
            '## Curbpack check',
            '',
            passed ? `**Readiness:** ${score}% \`${thermo}\` — gates green` : `**REMEDIATION REVIEW** — readiness ${score}% \`${thermo}\` — gates red (not release sign-off)`,
            '',
            fails.length ? '### Top findings\n' + fails.join('\n') : '### Top findings\n_No gate failures in cache._',
            '',
            !passed && report ? '<details><summary>Action Report (truncated)</summary>\n\n' + report + '\n</details>' : '',
            '',
            '_Prefer PR annotations / SARIF over this comment for full detail._',
            '',
            `> ${claim}`,
            '',
            '_Ask:_ `curbpack ask .github/curbpack/cache/latest_failure.json --propose`',
          ].filter(Boolean).join('\n');

          if (existing) {
            await github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: existing.id,
              body,
            });
          } else {
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            });
          }

    - name: Fail job if check failed
      if: steps.run.outputs.passed != 'true'
      shell: bash
      run: |
        echo "curbpack check failed (not a certification result — evidence for human review)."
        exit 1