action.yml

# RAC PR-gate composite action (v0.21.14, ADR-049 / ADR-063).
#
# Carries the full RAC contract into a single required pull-request check:
# install RAC and run `decided gate` — one command that enforces validation,
# relationship integrity, and review under the corpus enforcement policy
# (`.rac/config.yaml`), emitting one SARIF document (ADR-054). The single SARIF
# is uploaded to GitHub Code Scanning under one category (`rac-gate`), and the
# CLI exit code is re-surfaced. The action is a thin consumer (ADR-063): all
# analysis and enforcement policy live in the package (ADR-015 / ADR-049); the
# action never reinterprets findings or decides what is blocking.
#
# The Watchkeeper action lives at `watchkeeper/github/` and the validate
# (Registrar) action at `registrar/github/`; this gate is referenced as
# `uses: asdecided/ci/gatekeeper/github@<ref>`.
name: "As Decided Gatekeeper"
description: >-
  Enforce an As Decided knowledge corpus on a pull request with a single
  `decided gate` command — validation, relationship integrity, and review under the
  corpus enforcement policy — surfaced inline via GitHub Code Scanning (SARIF) as
  a required status check. A thin wrapper over the native `decided` CLI.
author: "Tom Ballard"

branding:
  icon: "shield"
  color: "purple"

inputs:
  path:
    description: "The As Decided corpus directory to enforce."
    required: false
    default: "decisions"
  upload-sarif:
    description: >-
      Upload SARIF to GitHub Code Scanning (`true` or `false`). Requires the job
      to grant `security-events: write`.
    required: false
    default: "true"
  sarif-dir:
    description: "Directory the single `gate.sarif` document is written to."
    required: false
    default: "rac-sarif"
  asdecided-version:
    description: >-
      Verified native asdecided-core release to install.
    required: false
    default: "0.24.0"

runs:
  using: "composite"
  steps:
    - name: Install AsDecided
      shell: bash
      run: |
        bash "$GITHUB_ACTION_PATH/../../shared/install-native.sh" \
          "${{ inputs.asdecided-version }}"

    # The CLI is the source of truth (ADR-058). `set +e` lets a non-zero exit
    # still produce SARIF for upload; the exit code is re-surfaced below. One
    # command, one SARIF document — `decided gate` already composes validation,
    # relationships, and review under the corpus enforcement policy.
    - name: Run RAC gate (SARIF)
      id: gate
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        SARIF_DIR: ${{ inputs.sarif-dir }}
      run: |
        set +e
        mkdir -p "$SARIF_DIR"
        decided gate "$INPUT_PATH" --sarif > "$SARIF_DIR/gate.sarif"
        code=$?
        echo "gate exited $code"
        echo "exit_code=$code" >> "$GITHUB_OUTPUT"

    # A single SARIF document uploaded under one Code Scanning category. The gate
    # is one tool ("rac") producing one run, so one categorised analysis suffices.
    - name: Upload gate SARIF
      if: ${{ always() && inputs.upload-sarif == 'true' }}
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ inputs.sarif-dir }}/gate.sarif
        category: asdecided-gatekeeper

    # Any non-zero CLI exit fails the check; the Code Scanning annotations show
    # every finding, blocking and advisory. What is blocking is decided by the
    # engine under the corpus enforcement policy (ADR-049), not here.
    - name: Report result
      shell: bash
      env:
        EXIT_CODE: ${{ steps.gate.outputs.exit_code }}
      run: |
        if [ "$EXIT_CODE" != "0" ]; then
          echo "::error::As Decided Gatekeeper failed (exit $EXIT_CODE) — see Code Scanning annotations."
          exit "$EXIT_CODE"
        fi
        echo "As Decided Gatekeeper passed."