action.yml

name: 'OpsScript Gate'
description: 'Cross-distro shell script compatibility and portability checker for Debian, Ubuntu, and Alpine. Runs real containers to diagnose command not found.'
author: 'Mresyzz'
branding:
  icon: 'shield'
  color: 'blue'

inputs:
  script-path:
    description: 'Path to the target shell script to test (auto-discovers repository scripts if omitted)'
    required: false
    default: ''
  matrix:
    description: 'Comma-separated container images to test (maximum: 32; e.g. debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20)'
    required: false
    default: ''
  jobs:
    description: 'Number of parallel container execution jobs (default: min(2, matrix_size))'
    required: false
    default: ''
  timeout:
    description: 'Hard timeout in seconds per container (default: 60, maximum: 3600)'
    required: false
    default: ''
  repeat:
    description: 'Repeat each distribution run to detect flaky runtime behavior (default: 1, maximum: 20)'
    required: false
    default: ''
  format:
    description: 'Output report format: table, markdown, json, or sarif'
    required: false
    default: ''
  shell:
    description: "Shell execution mode: 'posix' (default), 'shebang', or 'auto'"
    required: false
    default: ''
  mem-limit:
    description: 'Memory limit for containers (default: 256m)'
    required: false
    default: ''
  pids-limit:
    description: 'Maximum number of processes per container (default: 128)'
    required: false
    default: ''
  network:
    description: "Container network mode: 'bridge' or 'none' (default: bridge)"
    required: false
    default: ''
  packages:
    description: 'Optional comma- or newline-separated packages to install before running (requires network=bridge)'
    required: false
    default: ''

  config:
    description: 'Path to project JSON configuration'
    required: false
    default: ''
  preset:
    description: 'Distribution preset: minimal or ubuntu'
    required: false
    default: ''
  exclude:
    description: 'Newline-separated repository-relative exclusion globs'
    required: false
    default: ''
  max-scripts:
    description: 'Maximum discovered scripts; exceeding the limit fails'
    required: false
    default: ''
  dry-run:
    description: 'Preview the execution plan without Docker'
    required: false
    default: 'false'
  output:
    description: 'Save a report file for upload-artifact or other tooling'
    required: false
    default: ''
  changed-since:
    description: 'Only test shell scripts changed between this Git revision and HEAD'
    required: false
    default: ''

runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: '3.12'

    - name: Install opsscript-gate
      shell: bash
      run: |
        pip install "${{ github.action_path }}"

    - name: Run compatibility gate
      shell: bash
      env:
        INPUT_SCRIPT_PATH: ${{ inputs.script-path }}
        INPUT_MATRIX: ${{ inputs.matrix }}
        INPUT_JOBS: ${{ inputs.jobs }}
        INPUT_TIMEOUT: ${{ inputs.timeout }}
        INPUT_REPEAT: ${{ inputs.repeat }}
        INPUT_FORMAT: ${{ inputs.format }}
        INPUT_SHELL: ${{ inputs.shell }}
        INPUT_MEM_LIMIT: ${{ inputs.mem-limit }}
        INPUT_PIDS_LIMIT: ${{ inputs.pids-limit }}
        INPUT_NETWORK: ${{ inputs.network }}
        INPUT_PACKAGES: ${{ inputs.packages }}
        INPUT_CONFIG: ${{ inputs.config }}
        INPUT_PRESET: ${{ inputs.preset }}
        INPUT_EXCLUDE: ${{ inputs.exclude }}
        INPUT_MAX_SCRIPTS: ${{ inputs.max-scripts }}
        INPUT_DRY_RUN: ${{ inputs.dry-run }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_CHANGED_SINCE: ${{ inputs.changed-since }}
      run: |
        ARGS=("run")
        if [ -n "$INPUT_SCRIPT_PATH" ]; then
          ARGS+=("$INPUT_SCRIPT_PATH")
        fi
        # Only explicit inputs override project configuration.
        [ -z "$INPUT_TIMEOUT" ] || ARGS+=(--timeout "$INPUT_TIMEOUT")
        [ -z "$INPUT_REPEAT" ] || ARGS+=(--repeat "$INPUT_REPEAT")
        [ -z "$INPUT_FORMAT" ] || ARGS+=(--format "$INPUT_FORMAT")
        [ -z "$INPUT_SHELL" ] || ARGS+=(--shell "$INPUT_SHELL")
        [ -z "$INPUT_MEM_LIMIT" ] || ARGS+=(--mem-limit "$INPUT_MEM_LIMIT")
        [ -z "$INPUT_PIDS_LIMIT" ] || ARGS+=(--pids-limit "$INPUT_PIDS_LIMIT")
        [ -z "$INPUT_NETWORK" ] || ARGS+=(--network "$INPUT_NETWORK")
        [ -z "$INPUT_PACKAGES" ] || ARGS+=(--packages "$INPUT_PACKAGES")
        [ -z "$INPUT_MATRIX" ] || ARGS+=(--matrix "$INPUT_MATRIX")
        [ -z "$INPUT_JOBS" ] || ARGS+=(--jobs "$INPUT_JOBS")
        [ -z "$INPUT_CONFIG" ] || ARGS+=(--config "$INPUT_CONFIG")
        [ -z "$INPUT_PRESET" ] || ARGS+=(--preset "$INPUT_PRESET")
        [ -z "$INPUT_MAX_SCRIPTS" ] || ARGS+=(--max-scripts "$INPUT_MAX_SCRIPTS")
        [ -z "$INPUT_OUTPUT" ] || ARGS+=(--output "$INPUT_OUTPUT")
        [ -z "$INPUT_CHANGED_SINCE" ] || ARGS+=(--changed-since "$INPUT_CHANGED_SINCE")
        while IFS= read -r pattern; do
          pattern="${pattern%$'\r'}"
          [ -z "$pattern" ] || ARGS+=("--exclude" "$pattern")
        done <<< "$INPUT_EXCLUDE"
        DRY_RUN_VALUE="$(printf '%s' "$INPUT_DRY_RUN" | tr '[:upper:]' '[:lower:]')"
        if [ "$DRY_RUN_VALUE" = "true" ]; then
          ARGS+=("--dry-run")
        elif [ "$DRY_RUN_VALUE" != "false" ]; then
          echo "dry-run must be true or false" >&2
          exit 1
        fi
        python -m opsscript_gate.cli "${ARGS[@]}"