action.yml

name: "AgentConfigScore Regression Gate"
description: "Block pull requests that make AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, or other coding-agent instructions worse."
author: "Zhibo Lin"

branding:
  icon: "shield"
  color: "green"

inputs:
  base-sha:
    description: "Baseline commit SHA. Defaults to the pull request base SHA."
    required: false
    default: ""
  max-drop:
    description: "Optional override for policy.max_drop. Empty uses the baseline repository policy or 0."
    required: false
    default: ""
  fail-on-new-errors:
    description: "Optional override for policy.fail_on_new_errors. Empty uses the baseline policy, or true when no policy file exists."
    required: false
    default: ""
  python-version:
    description: "Python version used to run AgentConfigScore."
    required: false
    default: "3.12"

outputs:
  base-score:
    description: "AgentConfigScore for the baseline revision."
    value: ${{ steps.regression.outputs.base-score }}
  head-score:
    description: "AgentConfigScore for the candidate revision."
    value: ${{ steps.regression.outputs.head-score }}
  delta:
    description: "Candidate score minus baseline score."
    value: ${{ steps.regression.outputs.delta }}
  new-findings:
    description: "Number of newly introduced findings."
    value: ${{ steps.regression.outputs.new-findings }}
  new-errors:
    description: "Number of newly introduced error-severity findings."
    value: ${{ steps.regression.outputs.new-errors }}
  resolved-findings:
    description: "Number of findings resolved by the candidate revision."
    value: ${{ steps.regression.outputs.resolved-findings }}

runs:
  using: "composite"
  steps:
    - name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: ${{ inputs.python-version }}

    - name: Install AgentConfigScore
      shell: bash
      run: python -m pip install --disable-pip-version-check "${{ github.action_path }}"

    - name: Check agent-config regression
      id: regression
      shell: bash
      env:
        ACS_BASE_SHA: ${{ inputs.base-sha }}
        ACS_EVENT_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        ACS_MAX_DROP: ${{ inputs.max-drop }}
        ACS_FAIL_ON_NEW_ERRORS: ${{ inputs.fail-on-new-errors }}
      run: |
        set -euo pipefail

        base_sha="${ACS_BASE_SHA:-$ACS_EVENT_BASE_SHA}"
        if [[ -z "$base_sha" ]]; then
          echo "::error::AgentConfigScore needs a base SHA. Use this action on pull_request or set 'base-sha'."
          exit 2
        fi
        if ! [[ "$base_sha" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
          echo "::error::Invalid base SHA: $base_sha"
          exit 2
        fi
        if [[ -n "$ACS_MAX_DROP" ]] && ! [[ "$ACS_MAX_DROP" =~ ^[0-9]+$ ]]; then
          echo "::error::max-drop must be a non-negative integer"
          exit 2
        fi
        if [[ -n "$ACS_FAIL_ON_NEW_ERRORS" && "$ACS_FAIL_ON_NEW_ERRORS" != "true" && "$ACS_FAIL_ON_NEW_ERRORS" != "false" ]]; then
          echo "::error::fail-on-new-errors must be 'true' or 'false'"
          exit 2
        fi

        if ! git cat-file -e "${base_sha}^{commit}" 2>/dev/null; then
          git fetch --no-tags --depth=1 origin "$base_sha"
        fi

        base_dir="$RUNNER_TEMP/agent-config-score-base-${GITHUB_RUN_ID:-run}"
        summary="$RUNNER_TEMP/agent-config-score-summary-${GITHUB_RUN_ID:-run}.md"
        result_json="$RUNNER_TEMP/agent-config-score-result-${GITHUB_RUN_ID:-run}.json"
        git worktree remove --force "$base_dir" >/dev/null 2>&1 || true
        git worktree prune
        git worktree add --detach "$base_dir" "$base_sha"

        cleanup() {
          git worktree remove --force "$base_dir" >/dev/null 2>&1 || true
          git worktree prune >/dev/null 2>&1 || true
        }
        trap cleanup EXIT

        if [[ -f "$base_dir/.agentconfigscore.json" ]]; then
          echo "AgentConfigScore policy: baseline .agentconfigscore.json"
        else
          echo "AgentConfigScore policy: compatibility defaults (no baseline .agentconfigscore.json)"
        fi

        args=(
          compare "$base_dir" "$GITHUB_WORKSPACE"
          --markdown "$summary"
          --explain
          --json
        )

        if [[ -n "$ACS_MAX_DROP" ]]; then
          args+=(--max-drop "$ACS_MAX_DROP")
        fi

        if [[ -n "$ACS_FAIL_ON_NEW_ERRORS" ]]; then
          if [[ "$ACS_FAIL_ON_NEW_ERRORS" == "true" ]]; then
            args+=(--fail-on-new-errors)
          else
            args+=(--no-fail-on-new-errors)
          fi
        elif [[ ! -f "$base_dir/.agentconfigscore.json" ]]; then
          # Preserve the Action's historical default when a repository has not
          # opted into an explicit policy file yet.
          args+=(--fail-on-new-errors)
        fi

        set +e
        agent-config-score "${args[@]}" > "$result_json"
        status=$?
        set -e

        if [[ -f "$summary" && -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
          cat "$summary" >> "$GITHUB_STEP_SUMMARY"
        fi

        if [[ -s "$result_json" ]]; then
          python - "$result_json" "$GITHUB_OUTPUT" <<'PY'
        import json
        import sys

        result_path, output_path = sys.argv[1:]
        with open(result_path, encoding="utf-8") as handle:
            data = json.load(handle)

        outputs = {
            "base-score": data["base"]["score"],
            "head-score": data["head"]["score"],
            "delta": data["delta"],
            "new-findings": len(data["new_findings"]),
            "new-errors": sum(1 for finding in data["new_findings"] if finding["severity"] == "error"),
            "resolved-findings": len(data["resolved_findings"]),
        }

        with open(output_path, "a", encoding="utf-8") as handle:
            for key, value in outputs.items():
                print(f"{key}={value}", file=handle)
        PY
        fi

        exit "$status"