action.yml

name: Artifact Policy Engine
description: Scan, harden, sign, and verify release artifacts before they ship.
author: Helixar AI

branding:
  icon: shield
  color: blue

inputs:
  path:
    description: Path to artifact directory or archive to scan
    required: false
    default: ./dist
  config:
    description: Path to .releaseguard.yml config file
    required: false
    default: .releaseguard.yml
  # NOTE: fail-on is NOT a CLI flag. Severity gating is configured via
  # policy.fail-on in .releaseguard.yml. This input is kept for documentation
  # purposes only and does not affect CLI behaviour.
  fail-on:
    description: >
      Severity levels that fail the build (critical, high, medium, low).
      Configure this in .releaseguard.yml under policy.fail-on — the CLI
      reads it from config, not from a command-line flag.
    required: false
    default: critical,high
  sbom:
    description: Generate a Software Bill of Materials
    required: false
    default: "false"
  fix:
    description: Apply safe hardening transforms before scanning
    required: false
    default: "false"
  obfuscation:
    description: Obfuscation level (none, light — medium/aggressive require Cloud)
    required: false
    default: none
  sign:
    description: Sign the artifact after scanning (keyless, local, none)
    required: false
    default: none
  format:
    description: Report format (cli, json, sarif, html)
    required: false
    default: sarif
  create-issues:
    description: >
      Automatically create a GitHub issue when critical vulnerabilities are
      found. Requires the workflow token to have issues:write permission.
    required: false
    default: "false"
  token:
    description: ReleaseGuard Cloud API token (optional — enables Cloud features)
    required: false
    default: ""
  artifact-name:
    description: >
      Name for the uploaded evidence bundle artifact. Override when calling
      ReleaseGuard multiple times in the same workflow run to avoid 409 conflicts.
    required: false
    default: releaseguard-evidence

outputs:
  result:
    description: Policy result (pass, warn, fail)
    value: ${{ steps.check.outputs.result }}
  report-path:
    description: Path to generated report file
    value: ${{ steps.check.outputs.report-path }}
  evidence-dir:
    description: Path to evidence bundle directory
    value: .releaseguard

runs:
  using: composite
  steps:
    - name: Install releaseguard
      shell: bash
      run: |
        # $HOME/.local/bin is not pre-created on GitHub-hosted runners.
        mkdir -p "$HOME/.local/bin"
        curl -sSfL https://raw.githubusercontent.com/Helixar-AI/ReleaseGuard/main/scripts/install.sh | sh
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

    - name: Apply hardening transforms
      if: inputs.fix == 'true'
      shell: bash
      run: releaseguard fix "${{ inputs.path }}" --config "${{ inputs.config }}"

    - name: Apply obfuscation
      if: inputs.obfuscation != 'none'
      shell: bash
      run: releaseguard obfuscate "${{ inputs.path }}" --level "${{ inputs.obfuscation }}"

    - name: Run releaseguard check
      id: check
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.create-issues == 'true' && github.token || '' }}
      run: |
        REPORT=".releaseguard/report.${{ inputs.format }}"
        # Capture exit code so we always write outputs even on policy failure.
        releaseguard check "${{ inputs.path }}" \
          --config "${{ inputs.config }}" \
          --format "${{ inputs.format }}" \
          --out "$REPORT" || CHECK_EXIT=$?
        echo "report-path=${REPORT}" >> "$GITHUB_OUTPUT"
        echo "evidence-dir=.releaseguard" >> "$GITHUB_OUTPUT"
        if [ "${CHECK_EXIT:-0}" -ne 0 ]; then
          echo "result=fail" >> "$GITHUB_OUTPUT"
          exit "${CHECK_EXIT}"
        fi
        echo "result=pass" >> "$GITHUB_OUTPUT"

    - name: Generate SBOM
      if: always() && inputs.sbom == 'true'
      shell: bash
      run: releaseguard sbom "${{ inputs.path }}" --config "${{ inputs.config }}"

    - name: Sign artifact
      if: inputs.sign != 'none'
      shell: bash
      run: releaseguard sign "${{ inputs.path }}" --mode "${{ inputs.sign }}"

    - name: Upload evidence bundle
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: ${{ inputs.artifact-name }}
        path: .releaseguard/
        if-no-files-found: warn
        include-hidden-files: true