governance-consistency.yml

name: Governance Consistency Check

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: governance-consistency-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  check-consistency:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Bash Syntax Check
        shell: bash
        run: |
          set -euo pipefail
          failed=0
          for f in ops/*.sh; do
            if ! bash -n "$f"; then
              echo "FAIL: bash -n $f" >&2
              failed=1
            fi
          done
          exit "$failed"

      - name: Run Onboarding Hard Gate
        shell: bash
        run: |
          set -euo pipefail
          ./ops/enforce_agent_onboarding_gate.sh

      - name: Run Governance Consistency Check
        shell: bash
        run: |
          set -euo pipefail
          ./ops/check_release_governance_consistency.sh

      - name: Task Log Gate Check
        shell: bash
        run: |
          set -euo pipefail
          echo "== Checking if non-exempt changes include task logs =="

          CHANGED=""
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE_SHA="${{ github.event.pull_request.base.sha }}"
            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
            CHANGED="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" || true)"
          elif [[ "${{ github.event_name }}" == "push" ]]; then
            BEFORE_SHA="${{ github.event.before }}"
            AFTER_SHA="${{ github.sha }}"
            if [[ -n "$BEFORE_SHA" && ! "$BEFORE_SHA" =~ ^0+$ ]]; then
              CHANGED="$(git diff --name-only "$BEFORE_SHA" "$AFTER_SHA" || true)"
            else
              CHANGED="$(git show --pretty='' --name-only "$AFTER_SHA" || true)"
            fi
          fi

          if [[ -z "$CHANGED" ]]; then
            echo "No changed files detected, skip."
            exit 0
          fi

          TASK_LOG_CHECK_FILES="$CHANGED" TASK_LOG_WAIVER=0 TASK_LOG_STRICT=1 ./ops/pre-commit-log-check.sh