action.yml

# RAC validate composite action (v0.17.2, ADR-058).
#
# A thin wrapper: install RAC, run one `decided validate --sarif`, upload the SARIF
# to GitHub Code Scanning, and re-surface the CLI exit code. All analysis and
# severity policy live in the package (ADR-015 / ADR-053); the action never
# reinterprets findings. The Watchkeeper action lives at `watchkeeper/github/`;
# this Registrar (validate) action is referenced as
# `uses: asdecided/ci/registrar/github@<ref>`.
name: "As Decided Registrar"
description: >-
  Validate an As Decided knowledge corpus and surface findings on the pull
  request via GitHub Code Scanning (SARIF). A thin wrapper over `decided`.
author: "Tom Ballard"

branding:
  icon: "check-circle"
  color: "purple"

inputs:
  path:
    description: "The As Decided corpus directory to validate."
    required: false
    default: "decisions"
  upload-sarif:
    description: >-
      Upload SARIF to GitHub Code Scanning (`true` or `false`). Requires the job
      to grant `security-events: write`.
    required: false
    default: "true"
  sarif-file:
    description: "Where the SARIF document is written."
    required: false
    default: "rac.sarif"
  asdecided-version:
    description: >-
      Verified native asdecided-core release to install.
    required: false
    default: "0.24.0"

runs:
  using: "composite"
  steps:
    - name: Install AsDecided
      shell: bash
      run: |
        bash "$GITHUB_ACTION_PATH/../../shared/install-native.sh" \
          "${{ inputs.asdecided-version }}"

    # The CLI is the source of truth (ADR-058). `set +e` lets a non-zero exit
    # still produce SARIF for upload; the exit code is re-surfaced below.
    - name: Run decided validate (SARIF)
      id: validate
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        SARIF_FILE: ${{ inputs.sarif-file }}
      run: |
        set +e
        decided validate "$INPUT_PATH" --sarif > "$SARIF_FILE"
        echo "exit_code=$?" >> "$GITHUB_OUTPUT"

    - name: Upload SARIF to Code Scanning
      if: ${{ always() && inputs.upload-sarif == 'true' }}
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ inputs.sarif-file }}

    # Errors fail the check; warnings (including findings downgraded in
    # .rac/config.yaml, ADR-053) annotate without failing — warnings-first.
    - name: Report result
      shell: bash
      env:
        EXIT_CODE: ${{ steps.validate.outputs.exit_code }}
      run: |
        if [ "$EXIT_CODE" != "0" ]; then
          echo "::error::decided validate exited $EXIT_CODE — see the Code Scanning annotations."
          exit "$EXIT_CODE"
        fi
        echo "decided validate passed."