action.yml

name: "PyGate Quality Gates"
description: "Run deterministic Python quality gates with bounded repair"
author: "Hermes Labs"

branding:
  icon: "check-circle"
  color: "green"

inputs:
  mode:
    description: "Gate mode: canary (lint+typecheck, tests optional) or full (all gates)"
    default: "canary"
  repair:
    description: "Run bounded repair after failures; when true, may mutate files in the consumer workspace"
    default: "false"
  max-attempts:
    description: "Maximum repair attempts before escalation"
    default: "3"
  python-version:
    description: "Python version to use"
    default: "3.12"
  post-comment:
    description: "Post findings as a PR comment; when true, requires pull-requests: write"
    default: "false"
  changed-files:
    description: "Optional path to a newline-delimited or JSON changed-files list"
    default: ""
  artifact-name:
    description: "Name for the uploaded PyGate artifact bundle"
    default: "pygate-artifacts"
  fail-on-error:
    description: "Fail the action when quality gates fail or repair does not pass; set to false for observation-only reporting"
    default: "true"

outputs:
  status:
    description: "Final result after the quality gate and optional repair: pass, fail, or escalated"
    value: ${{ steps.final.outputs.status }}
  gate-status:
    description: "Initial quality-gate result before optional repair: pass or fail"
    value: ${{ steps.gate.outputs.status }}
  failures-json:
    description: "Path to .pygate/failures.json"
    value: ${{ steps.gate.outputs.failures_json }}
  repair-status:
    description: "Repair result: pass, escalated, or skipped"
    value: ${{ steps.repair.outputs.status || steps.repair-skip.outputs.status }}
  changed-files-strategy:
    description: "Changed-file source: caller-supplied, pull-request diff, push diff, parent diff, or tracked-file fallback"
    value: ${{ steps.changes.outputs.strategy }}
  full-mode-dependency-status:
    description: "Full-mode dependency preflight: ready, missing, or not-required"
    value: ${{ steps.full-deps.outputs.status || steps.full-deps-skip.outputs.status }}
  full-mode-dependency-classification:
    description: "Full-mode dependency diagnostic classification"
    value: ${{ steps.full-deps.outputs.classification || steps.full-deps-skip.outputs.classification }}

runs:
  using: "composite"
  steps:
    - name: Validate action inputs
      id: validate
      shell: bash
      env:
        PYGATE_MODE: ${{ inputs.mode }}
        PYGATE_REPAIR: ${{ inputs.repair }}
        PYGATE_POST_COMMENT: ${{ inputs.post-comment }}
        PYGATE_FAIL_ON_ERROR: ${{ inputs.fail-on-error }}
        PYGATE_MAX_ATTEMPTS: ${{ inputs.max-attempts }}
        PYGATE_CHANGED_FILES: ${{ inputs.changed-files }}
      run: |
        set -euo pipefail

        case "$PYGATE_MODE" in
          canary|full)
            ;;
          *)
            echo "::error::Invalid mode: $PYGATE_MODE (must be canary or full)"
            exit 2
            ;;
        esac

        for input_name in PYGATE_REPAIR PYGATE_POST_COMMENT PYGATE_FAIL_ON_ERROR; do
          input_value="${!input_name}"
          case "$input_value" in
            true|false)
              ;;
            *)
              echo "::error::Invalid boolean input $input_name: $input_value (must be true or false)"
              exit 2
              ;;
          esac
        done

        if [[ ! "$PYGATE_MAX_ATTEMPTS" =~ ^[1-9][0-9]*$ ]] || (( PYGATE_MAX_ATTEMPTS > 10 )); then
          echo "::error::Invalid max-attempts: $PYGATE_MAX_ATTEMPTS (must be a positive integer no greater than 10)"
          exit 2
        fi

        if [[ -n "$PYGATE_CHANGED_FILES" ]]; then
          if [[ ! -f "$PYGATE_CHANGED_FILES" ]]; then
            echo "::error::changed-files path does not exist: $PYGATE_CHANGED_FILES"
            exit 2
          fi
          if [[ ! -s "$PYGATE_CHANGED_FILES" ]]; then
            echo "::error::changed-files file is empty: $PYGATE_CHANGED_FILES"
            exit 2
          fi
        fi

    - name: Set up Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ inputs.python-version }}

    - name: Validate changed-files content
      if: inputs.changed-files != ''
      shell: bash
      env:
        PYGATE_CHANGED_FILES: ${{ inputs.changed-files }}
      run: |
        set -euo pipefail
        # BEGIN PYGATE_CHANGED_FILES_VALIDATOR
        python - "$PYGATE_CHANGED_FILES" <<'PY'
        import json
        import sys
        from pathlib import Path

        path = Path(sys.argv[1])
        content = path.read_text(encoding="utf-8").strip()
        if not content:
            raise SystemExit("changed-files content contains no usable paths")

        if content.startswith("["):
            try:
                parsed = json.loads(content)
            except json.JSONDecodeError as exc:
                raise SystemExit(f"changed-files JSON is malformed: {exc}") from exc
            if not isinstance(parsed, list):
                raise SystemExit("changed-files JSON must be a list")
            changed_files = [item for item in parsed if isinstance(item, str) and item.strip()]
        else:
            changed_files = [line.strip() for line in content.splitlines() if line.strip()]

        if not changed_files:
            raise SystemExit("changed-files content contains no usable paths")
        print(f"Validated {len(changed_files)} changed-file path(s)")
        PY
        # END PYGATE_CHANGED_FILES_VALIDATOR

    - name: Install checked-out PyGate action source
      shell: bash
      run: |
        ACTION_ROOT="$GITHUB_ACTION_PATH"
        python -m pip install "$ACTION_ROOT" ruff pyright

    - name: Preflight full-mode test dependencies
      id: full-deps
      if: inputs.mode == 'full'
      shell: bash
      run: |
        set -euo pipefail
        missing=()
        python -c 'import pytest' >/dev/null 2>&1 || missing+=(pytest)
        python -c 'import pytest_jsonreport' >/dev/null 2>&1 || missing+=(pytest-json-report)
        if (( ${#missing[@]} > 0 )); then
          echo "status=missing" >> "$GITHUB_OUTPUT"
          echo "classification=missing-test-dependency" >> "$GITHUB_OUTPUT"
          echo "::error::Full mode requires caller-installed project/test dependencies: ${missing[*]}. Install them before invoking PyGate, for example: python -m pip install -e '.[dev]' (or pytest pytest-json-report)."
          exit 2
        fi
        echo "status=ready" >> "$GITHUB_OUTPUT"
        echo "classification=caller-owned-dependencies" >> "$GITHUB_OUTPUT"

    - name: Mark full-mode dependency preflight not required
      id: full-deps-skip
      if: inputs.mode != 'full'
      shell: bash
      run: |
        echo "status=not-required" >> "$GITHUB_OUTPUT"
        echo "classification=canary-does-not-run-tests" >> "$GITHUB_OUTPUT"

    - name: Detect changed files
      id: changes
      shell: bash
      env:
        CHANGED_FILES_INPUT: ${{ inputs.changed-files }}
        EVENT_NAME: ${{ github.event_name }}
        PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        PUSH_BEFORE_SHA: ${{ github.event.before }}
        CURRENT_SHA: ${{ github.sha }}
      run: |
        set -euo pipefail
        changed_file_path=".pygate-changed-files.txt"
        strategy=""

        tracked_files_fallback() {
          if git ls-files --cached -- > "$changed_file_path" && [[ -s "$changed_file_path" ]]; then
            strategy="$1"
            return 0
          fi
          echo "::error::Changed-file discovery could not produce a tracked path list"
          exit 2
        }

        valid_commit() {
          local revision="$1"
          [[ -n "$revision" ]] && git rev-parse --verify --quiet --end-of-options "${revision}^{commit}" >/dev/null 2>&1
        }

        write_diff() {
          local left="$1"
          local right="$2"
          local label="$3"
          if git diff --name-only --no-renames --end-of-options "$left" "$right" -- > "$changed_file_path" && [[ -s "$changed_file_path" ]]; then
            strategy="$label"
          else
            tracked_files_fallback "${label}-tracked-files-fallback"
          fi
        }

        current_revision="$CURRENT_SHA"
        if ! valid_commit "$current_revision"; then
          current_revision="$(git rev-parse --verify --quiet --end-of-options 'HEAD^{commit}' || true)"
        fi
        parent_revision=""
        if valid_commit "$current_revision"; then
          parent_revision="$(git rev-list --parents -n 1 --end-of-options "$current_revision" | awk 'NF > 1 { print $2 }')"
        fi

        if [[ -n "$CHANGED_FILES_INPUT" ]]; then
          if [[ "$CHANGED_FILES_INPUT" != "$changed_file_path" ]]; then
            cp -- "$CHANGED_FILES_INPUT" "$changed_file_path"
          fi
          strategy="caller-supplied"
        elif [[ "$EVENT_NAME" == "pull_request" ]]; then
          if valid_commit "$PR_BASE_SHA" && valid_commit "$CURRENT_SHA"; then
            write_diff "$PR_BASE_SHA" "$CURRENT_SHA" "pull-request-diff"
          else
            tracked_files_fallback "pull-request-tracked-files-fallback"
          fi
        elif valid_commit "$PUSH_BEFORE_SHA" && valid_commit "$CURRENT_SHA"; then
          write_diff "$PUSH_BEFORE_SHA" "$CURRENT_SHA" "push-diff"
        elif valid_commit "$parent_revision"; then
          write_diff "$parent_revision" "$current_revision" "parent-diff"
        else
          tracked_files_fallback "first-or-shallow-tracked-files"
        fi

        if [[ ! -s "$changed_file_path" ]]; then
          echo "::error::Changed-file discovery produced no usable path list"
          exit 2
        fi
        echo "strategy=$strategy" >> "$GITHUB_OUTPUT"
        echo "Changed-file strategy: $strategy" >> "$GITHUB_STEP_SUMMARY"
        echo "Changed files:"
        cat .pygate-changed-files.txt

    - name: Run quality gates
      id: gate
      shell: bash
      env:
        PYGATE_MODE: ${{ inputs.mode }}
      run: |
        if [[ "$PYGATE_MODE" != "canary" && "$PYGATE_MODE" != "full" ]]; then
          echo "::error::Invalid mode: $PYGATE_MODE (must be canary or full)"
          exit 1
        fi
        rm -f .pygate/gate-result.json .pygate/failures.json
        set +e
        pygate run --mode "$PYGATE_MODE" --changed-files .pygate-changed-files.txt --output-dir .pygate
        EXIT_CODE=$?
        set -e
        case "$EXIT_CODE" in
          0|1)
            if [ ! -f .pygate/gate-result.json ] || [ ! -f .pygate/failures.json ]; then
              echo "::error::PyGate exited $EXIT_CODE without writing its required result artifacts"
              exit 2
            fi
            if [ "$EXIT_CODE" -eq 0 ]; then
              echo "status=pass" >> "$GITHUB_OUTPUT"
            else
              echo "status=fail" >> "$GITHUB_OUTPUT"
            fi
            ;;
          *)
            echo "::error::PyGate command failed with infrastructure exit code $EXIT_CODE"
            exit "$EXIT_CODE"
            ;;
        esac
        echo "failures_json=.pygate/failures.json" >> "$GITHUB_OUTPUT"

    - name: Run bounded repair
      id: repair
      if: steps.gate.outputs.status == 'fail' && inputs.repair == 'true'
      shell: bash
      env:
        PYGATE_MAX_ATTEMPTS: ${{ inputs.max-attempts }}
      run: |
        set +e
        pygate repair --input .pygate/failures.json --max-attempts "$PYGATE_MAX_ATTEMPTS"
        EXIT_CODE=$?
        set -e
        case "$EXIT_CODE" in
          0)
            echo "status=pass" >> "$GITHUB_OUTPUT"
            ;;
          2)
            echo "status=escalated" >> "$GITHUB_OUTPUT"
            ;;
          *)
            echo "status=fail" >> "$GITHUB_OUTPUT"
            echo "::error::PyGate repair command failed with infrastructure exit code $EXIT_CODE"
            exit "$EXIT_CODE"
            ;;
        esac

    - name: Set repair status to skipped
      id: repair-skip
      if: steps.gate.outputs.status != 'fail' || inputs.repair != 'true'
      shell: bash
      run: echo "status=skipped" >> "$GITHUB_OUTPUT"

    - name: Generate agent brief
      if: steps.gate.outputs.status == 'fail'
      shell: bash
      run: pygate summarize --input .pygate/failures.json

    - name: Post PR comment
      if: github.event_name == 'pull_request' && steps.gate.outputs.status == 'fail' && inputs.post-comment == 'true'
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      with:
        script: |
          const fs = require('fs');
          let body = '## PyGate Quality Gate Results\n\n';
          if (fs.existsSync('.pygate/agent-brief.md')) {
            body += fs.readFileSync('.pygate/agent-brief.md', 'utf8');
          } else {
            body += 'Gate failed. See artifacts for details.';
          }
          await github.rest.issues.createComment({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
            body: body,
          });

    - name: Upload artifacts
      id: artifacts
      if: always()
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ inputs.artifact-name }}
        path: .pygate/
        include-hidden-files: true
        if-no-files-found: ignore

    - name: Set final action status
      id: final
      if: always()
      shell: bash
      env:
        GATE_STATUS: ${{ steps.gate.outputs.status }}
        GATE_OUTCOME: ${{ steps.gate.outcome }}
        REPAIR_STATUS: ${{ steps.repair.outputs.status || steps.repair-skip.outputs.status }}
        REPAIR_OUTCOME: ${{ steps.repair.outcome }}
        ARTIFACT_OUTCOME: ${{ steps.artifacts.outcome }}
      run: |
        infrastructure_failure=false
        final_status=fail

        case "$GATE_STATUS" in
          pass|fail)
            ;;
          *)
            infrastructure_failure=true
            ;;
        esac

        if [[ "$GATE_OUTCOME" != "success" ]]; then
          infrastructure_failure=true
        fi
        if [[ "$REPAIR_OUTCOME" == "failure" ]]; then
          infrastructure_failure=true
        fi
        if [[ "$ARTIFACT_OUTCOME" != "success" ]]; then
          infrastructure_failure=true
        fi

        if [[ "$infrastructure_failure" == "false" ]]; then
          case "$GATE_STATUS:$REPAIR_STATUS" in
            pass:skipped|pass:pass)
              final_status=pass
              ;;
            fail:pass)
              final_status=pass
              ;;
            fail:escalated)
              final_status=escalated
              ;;
            fail:fail|fail:skipped)
              final_status=fail
              ;;
            *)
              infrastructure_failure=true
              ;;
          esac
        fi

        echo "status=$final_status" >> "$GITHUB_OUTPUT"
        echo "infrastructure_failure=$infrastructure_failure" >> "$GITHUB_OUTPUT"
        echo "Final action status: $final_status"
        echo "Initial gate status: ${GATE_STATUS:-unavailable}"
        echo "Repair status: ${REPAIR_STATUS:-unavailable}"
        echo "Infrastructure failure: $infrastructure_failure"

    - name: Enforce action outcome
      if: always()
      shell: bash
      env:
        FAIL_ON_ERROR: ${{ inputs.fail-on-error }}
        FINAL_STATUS: ${{ steps.final.outputs.status }}
        INFRASTRUCTURE_FAILURE: ${{ steps.final.outputs.infrastructure_failure }}
      run: |
        case "$FAIL_ON_ERROR" in
          true|false)
            ;;
          *)
            echo "::error::Invalid fail-on-error value: $FAIL_ON_ERROR (must be true or false)"
            exit 2
            ;;
        esac

        case "$FINAL_STATUS" in
          pass|fail|escalated)
            ;;
          *)
            echo "::error::Final action status was not produced"
            exit 2
            ;;
        esac

        if [[ "$INFRASTRUCTURE_FAILURE" == "true" ]]; then
          echo "::error::PyGate action failed before producing a trustworthy quality result"
          exit 1
        fi

        if [[ "$FAIL_ON_ERROR" == "false" ]]; then
          exit 0
        fi
        if [[ "$FINAL_STATUS" == "fail" || "$FINAL_STATUS" == "escalated" ]]; then
          echo "::error::PyGate quality gates did not pass"
          exit 1
        fi
        exit 0