action.yml

# RAC Watchkeeper composite action (v0.12.3).
#
# A thin wrapper: build the native CLI, resolve the base revision, run one
# `decided watchkeeper --format github` invocation, and route its outputs —
# stdout to the step summary, stderr (workflow-command annotations) to the
# step log. All analysis, rendering, and failure policy live in the Python
# engine (ADR-015); the action never reinterprets exit codes.
name: "RAC Watchkeeper"
description: >-
  Review product knowledge changes (requirements, decisions, roadmaps,
  designs, prompts) on pull requests: changed artifacts, validation and
  relationship deltas, deterministic intent findings, and a review verdict.
author: "Tom Ballard"

branding:
  icon: "eye"
  color: "purple"

inputs:
  path:
    description: >-
      Corpus directory to compare (passed to `decided watchkeeper`).
    required: false
    default: "decisions"
  base:
    description: >-
      Base state: a git revision or a directory. Empty (the default)
      resolves to `origin/<pull request base branch>`.
    required: false
    default: ""
  fail-on:
    description: >-
      Failure policy forwarded to `decided watchkeeper --fail-on`:
      `error` (fail when review is recommended), `warning` (also fail on
      any warning finding), or `none` (never fail, still report).
    required: false
    default: "error"
  annotate:
    description: >-
      Emit inline annotations via workflow commands (`true` or `false`).
    required: false
    default: "true"
runs:
  using: "composite"
  steps:
    - name: Build native AsDecided
      shell: bash
      run: |
        (cd "$GITHUB_ACTION_PATH/rust" && cargo build --release --locked -p decided -p decided-mcp)
        echo "$GITHUB_ACTION_PATH/rust/target/release" >> "$GITHUB_PATH"

    - name: Resolve base revision
      shell: bash
      env:
        INPUT_BASE: ${{ inputs.base }}
        PR_BASE_REF: ${{ github.base_ref }}
      run: |
        BASE="$INPUT_BASE"
        if [ -z "$BASE" ]; then
          BASE="origin/$PR_BASE_REF"
        fi
        # Make sure the base ref exists locally; harmless when it already
        # does, best-effort when the base is a directory or a plain SHA
        # (decided fails with exit 2 and a clear message if it cannot resolve).
        case "$BASE" in
          origin/*)
            REF="${BASE#origin/}"
            git fetch --quiet --no-tags origin \
              "+refs/heads/$REF:refs/remotes/origin/$REF" || true
            ;;
        esac
        echo "WATCHKEEPER_BASE=$BASE" >> "$GITHUB_ENV"

    - name: Run watchkeeper
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        FAIL_ON: ${{ inputs.fail-on }}
        ANNOTATE: ${{ inputs.annotate }}
      run: |
        ANNOTATE_FLAG=""
        if [ "$ANNOTATE" != "true" ]; then
          ANNOTATE_FLAG="--no-annotate"
        fi
        # stdout becomes the job's step summary; stderr stays in the live
        # step log where the runner parses the annotation commands. The
        # exit code propagates unchanged — policy lives in --fail-on.
        decided watchkeeper "$INPUT_PATH" \
          --base "$WATCHKEEPER_BASE" \
          --format github \
          --fail-on "$FAIL_ON" \
          $ANNOTATE_FLAG \
          > "$GITHUB_STEP_SUMMARY"