pr-checks.yml

name: PR Checks

# Pre-merge dogfood checks for the three native Actions.
on:
  pull_request:

permissions:
  contents: read

concurrency:
  group: pr-checks-${{ github.ref }}
  cancel-in-progress: true

jobs:
  release-changelog:
    name: release changelog contract
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Verify current version has one changelog entry
        run: |
          VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided") | .version')"
          ./scripts/verify-release-changelog.sh "$VERSION"

  # Watchkeeper dogfood (v0.12.3): every pull request here gets a product
  # knowledge review from the local action in source mode — which is also
  # the live end-to-end test of action.yml itself.
  watchkeeper:
    name: watchkeeper (dogfood, native)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: ./
        with:
          path: decisions

  # Validate dogfood (v0.17.2): every pull request runs the local validate
  # action in source mode — the live end-to-end test of validate-action/action.yml
  # (install, `decided validate --sarif`, exit-code propagation). SARIF uploads to
  # Code Scanning for same-repo PRs; it is skipped on forks, whose token cannot be
  # granted security-events: write, so the check never fails on a missing scope.
  validate:
    name: validate (dogfood, native)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: ./validate-action
        with:
          path: decisions
          upload-sarif: ${{ !github.event.pull_request.head.repo.fork }}

  # PR-gate dogfood (v0.21.14): every pull request runs the local PR-gate action
  # in source mode — the live end-to-end test of pr-gate-action/action.yml. It
  # carries the full contract via a single `decided gate` command — validation,
  # relationships, and review under the corpus enforcement policy — into one
  # required check, uploading one SARIF document under the Code Scanning category
  # `decided-gate` (distinct from the standalone validate job above, so the analyses
  # never collide). Skipped on forks, whose token cannot be granted
  # security-events: write.
  gate:
    name: pr-gate (dogfood, native)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: ./pr-gate-action
        with:
          path: decisions
          upload-sarif: ${{ !github.event.pull_request.head.repo.fork }}

  # Sentry dogfood: accepted decisions can carry deterministic source-code
  # constraints. Evaluate only the pull request diff against its base branch,
  # upload the native engine's SARIF, and block on any violation. No model,
  # embeddings, network judge, or second policy implementation is involved.
  sentry:
    name: sentry (dogfood, native)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Build native AsDecided
        run: cargo build --release --locked -p decided
        working-directory: rust

      - name: Run Sentry (SARIF)
        id: sentry
        env:
          BASE_REF: origin/${{ github.base_ref }}
        run: |
          set +e
          mkdir -p decided-sarif
          rust/target/release/decided sentry decisions \
            --base "$BASE_REF" \
            --sarif > decided-sarif/sentry.sarif
          code=$?
          echo "sentry exited $code"
          echo "exit_code=$code" >> "$GITHUB_OUTPUT"

      - name: Upload Sentry SARIF
        if: ${{ always() && !github.event.pull_request.head.repo.fork }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: decided-sarif/sentry.sarif
          category: decided-sentry

      - name: Report result
        env:
          EXIT_CODE: ${{ steps.sentry.outputs.exit_code }}
        run: |
          if [ "$EXIT_CODE" != "0" ]; then
            echo "::error::AsDecided Sentry failed (exit $EXIT_CODE) — see the Code Scanning annotations."
            exit "$EXIT_CODE"
          fi
          echo "AsDecided Sentry passed."

  # Keep public commands and generated agent guidance tied to the native
  # distribution. This job runs for docs-only changes too; rust-spike's path
  # filter is intentionally limited to engine/spec changes.
  guidance-drift:
    name: public docs and guidance drift
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Build native AsDecided
        working-directory: rust
        run: cargo build --release --locked -p decided

      - name: Check generated agent guidance
        run: rust/target/release/decided export decisions/ --agent-rules --check

      - name: Check public command and MCP contracts
        working-directory: rust
        run: cargo test -p decided-mcp --test docs_contract --release

  mcp-distribution:
    name: mcp distribution metadata
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Verify Registry and OCI metadata agree
        run: |
          WORKSPACE_VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided-mcp") | .version')"
          test "$(jq -r '.name' server.json)" = "io.github.asdecided/core"
          test "$(jq -r '.packages | length' server.json)" = "1"
          test "$(jq -r '.packages[0].registryType' server.json)" = "oci"
          test "$(jq -r '.packages[0].identifier' server.json)" = "ghcr.io/asdecided/core:mcp-v$WORKSPACE_VERSION"
          test "$(jq -r '.packages[0].transport.type' server.json)" = "stdio"
          test "$(jq -r '.version' server.json)" = "$WORKSPACE_VERSION"
          test "$(jq -r '.packages[0] | has("version")' server.json)" = "false"
          grep -F 'io.modelcontextprotocol.server.name="io.github.asdecided/core"' Dockerfile
          grep -F 'FROM runtime AS asdecided-mcp' Dockerfile
      # A release PR can point at an exact engine version that does not exist on
      # crates.io until the staged publish workflow runs. Listing the package
      # still validates its include/exclude boundary without falsely requiring
      # the unreleased dependency; crates-publish performs the full dry-run
      # after publishing and indexing asdecided-core.
      - name: Verify MCP crate package contents
        working-directory: rust
        run: cargo package --list --locked -p decided-mcp
      - name: Build and smoke-test Registry MCP image
        run: |
          WORKSPACE_VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided-mcp") | .version')"
          docker build --target asdecided-mcp --build-arg DECIDED_VERSION="$WORKSPACE_VERSION" -t asdecided-mcp:pr .
          RESPONSE="$(printf '%s\n' '{"jsonrpc":"2.0","id":"discover","method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"pr-smoke","version":"1.0.0"},"io.modelcontextprotocol/clientCapabilities":{}}}}' | docker run --rm -i -v "$PWD:/work:ro" asdecided-mcp:pr --root /work)"
          test "$(printf '%s' "$RESPONSE" | jq -r '.result.serverInfo.name')" = "decided-mcp"
          test "$(printf '%s' "$RESPONSE" | jq -r '.result.serverInfo.version')" = "$WORKSPACE_VERSION"