feat: first pass at a github action

.github/workflows/release.yml

@@ -3,8 +3,8 @@ name: Release
 on:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-      - 'v[0-9]+.[0-9]+.[0-9]+-*'
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+-*"
 
 permissions:
   contents: write

.github/workflows/test_action.yml

@@ -0,0 +1,24 @@
+name: Test Action
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  smoke-test:
+    name: Run action (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - name: Run embd action
+        uses: ./
+        with:
+          version: v0.1.1
+          args: status

README.md

@@ -65,7 +65,30 @@ To check for deviations, run:
 embd status
 ```
 
-This will print out any files that differ from the tracked revision of the pulled files. This is mostly useful for ensuring that files that are part of an "embed" are not inadvertently edited. This check can be used in CI workflows to ensure that such edits do not occur.
+This will print out any files that differ from the tracked revision of the pulled files. This is mostly useful for ensuring that files that are part of an "embed" are not inadvertently edited. This check can be used in [CI workflows](#use-in-ci-github-action) to ensure that such edits do not occur.
+
+## Use in CI (GitHub Action)
+
+You can run `embd status` in CI with the bundled GitHub Action. It downloads a prebuilt `embd` binary for the runner and runs `status`, failing the job if any embed has drifted:
+
+```yaml
+name: embd
+on: [push, pull_request]
+jobs:
+  embd:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ptsouchlos/embd@v0 # tracks the latest stable v0.x release; use @v0.1.0 to pin exactly
+```
+
+The `args` input overrides the command (default `status`), so you can scope the check to specific embeds or run quietly:
+
+```yaml
+      - uses: ptsouchlos/embd@v0
+        with:
+          args: status --quiet infra
+```
 
 ## Credits
 

action.yml

@@ -0,0 +1,83 @@
+name: 'embd'
+description: 'Check embedded-repo drift in CI with `embd status`'
+author: 'ptsouchlos'
+branding:
+  icon: 'git-merge'
+  color: 'purple'
+
+inputs:
+  args:
+    description: 'Arguments passed to embd'
+    required: false
+    default: 'status'
+  version:
+    description: 'embd release tag to use (e.g. v0.1.0). Defaults to the action ref, falling back to the latest release.'
+    required: false
+    default: ''
+  working-directory:
+    description: 'Directory to run embd in'
+    required: false
+    default: '.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Download embd
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        INPUT_VERSION: ${{ inputs.version }}
+        ACTION_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        REPO="ptsouchlos/embd"
+
+        VER="${INPUT_VERSION}"
+        if [ -z "$VER" ]; then
+          REF="${ACTION_REF:-}"
+          if [[ "$REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-.*)?$ ]]; then
+            # exact version tag, e.g. v0.1.0
+            VER="$REF"
+          elif [[ "$REF" =~ ^v[0-9]+$ ]]; then
+            # moving major tag, e.g. v1 -> newest non-prerelease v1.* release (list is newest-first)
+            VER="$(gh release list --repo "$REPO" --json tagName,isPrerelease \
+              --jq "map(select(.isPrerelease | not)) | map(.tagName) | map(select(startswith(\"${REF}.\"))) | first // \"\"")"
+          fi
+          if [ -z "$VER" ] || [ "$VER" = "null" ]; then
+            # branch/SHA or unresolved -> latest release
+            VER="$(gh release view --repo "$REPO" --json tagName --jq .tagName)"
+          fi
+        fi
+        echo "Using embd release: $VER"
+
+        case "${RUNNER_OS}-${RUNNER_ARCH}" in
+          Linux-X64)    TRIPLE=x86_64-unknown-linux-musl;  EXT=tar.gz ;;
+          Linux-ARM64)  TRIPLE=aarch64-unknown-linux-musl; EXT=tar.gz ;;
+          macOS-ARM64)  TRIPLE=aarch64-apple-darwin;       EXT=tar.gz ;;
+          Windows-X64)  TRIPLE=x86_64-pc-windows-msvc;     EXT=zip ;;
+          *) echo "::error::Unsupported platform ${RUNNER_OS}-${RUNNER_ARCH}" >&2; exit 1 ;;
+        esac
+
+        ASSET="embd-${TRIPLE}.${EXT}"
+        URL="https://github.com/${REPO}/releases/download/${VER}/${ASSET}"
+        DEST="${RUNNER_TEMP}/embd-bin"
+        mkdir -p "$DEST"
+        echo "Downloading $URL"
+        curl -fsSL "$URL" -o "${RUNNER_TEMP}/${ASSET}"
+        curl -fsSL "${URL}.sha256" -o "${RUNNER_TEMP}/${ASSET}.sha256"
+        ( cd "${RUNNER_TEMP}" && sha256sum -c "${ASSET}.sha256" )
+        if [ "$EXT" = "zip" ]; then
+          # zip assets are Windows-only, where 7z is always available (unzip may not be)
+          7z x -y -o"$DEST" "${RUNNER_TEMP}/${ASSET}" >/dev/null
+        else
+          tar -xzf "${RUNNER_TEMP}/${ASSET}" -C "$DEST"
+        fi
+        chmod +x "${DEST}/embd" 2>/dev/null || true
+        echo "$DEST" >> "$GITHUB_PATH"
+
+    - name: Run embd
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        INPUT_ARGS: ${{ inputs.args }}
+      run: embd $INPUT_ARGS