action.yml

name: ReproMin
description: Reduce a failing repository and upload the auditable reproduction as an artifact
author: ReproMin maintainers
branding:
  color: blue
  icon: minimize-2
outputs:
  payload-path:
    description: Absolute path to the minimized payload directory
    value: ${{ steps.reduce.outputs.payload-path }}
  report-path:
    description: Absolute path to the generated report.json
    value: ${{ steps.reduce.outputs.report-path }}
  metadata-path:
    description: Absolute path to the generated .repomin metadata directory
    value: ${{ steps.reduce.outputs.metadata-path }}
  artifact-name:
    description: Name of the uploaded GitHub Actions artifact
    value: ${{ inputs.artifact-name }}
  report-schema-version:
    description: Machine-readable report schema version
    value: ${{ steps.reduce.outputs.report-schema-version }}
  source-files:
    description: Number of files in the source tree before reduction
    value: ${{ steps.reduce.outputs.source-files }}
  source-bytes:
    description: Number of source bytes before reduction
    value: ${{ steps.reduce.outputs.source-bytes }}
  output-files:
    description: Number of files in the minimized payload
    value: ${{ steps.reduce.outputs.output-files }}
  output-bytes:
    description: Number of bytes in the minimized payload
    value: ${{ steps.reduce.outputs.output-bytes }}
  attempts:
    description: Logical candidate attempts performed by the reducer
    value: ${{ steps.reduce.outputs.attempts }}
  accepted-mutations:
    description: Candidate mutations promoted into the minimized tree
    value: ${{ steps.reduce.outputs.accepted-mutations }}
  holdout-status:
    description: Final holdout certification status from report.json
    value: ${{ steps.reduce.outputs.holdout-status }}
  oracle-mode:
    description: Privacy-safe failure oracle type from the validated report
    value: ${{ steps.reduce.outputs.oracle-mode }}
  file-retention-ratio:
    description: Fraction of source files retained in the minimized payload
    value: ${{ steps.reduce.outputs.file-retention-ratio }}
  byte-retention-ratio:
    description: Fraction of source bytes retained in the minimized payload
    value: ${{ steps.reduce.outputs.byte-retention-ratio }}
  payload-fingerprint-mode:
    description: Payload fingerprint evidence mode (exact, content, or unavailable)
    value: ${{ steps.reduce.outputs.payload-fingerprint-mode }}
  payload-fingerprint-verified:
    description: Whether the exported payload fingerprint was verified
    value: ${{ steps.reduce.outputs.payload-fingerprint-verified }}
  step-summary-path:
    description: Runner path to the generated step summary when enabled
    value: ${{ steps.reduce.outputs.step-summary-path }}
inputs:
  config:
    description: Repository-relative path to a versioned JSON reduction spec
    required: false
    default: ""
  command:
    description: Shell command that reproduces the failure
    required: false
    default: ""
  match:
    description: Optional regular expression that must remain in command output
    required: false
    default: ""
  exit-code:
    description: Optional exact process exit code required by the failure oracle
    required: false
    default: ""
  java-exception:
    description: Learn and preserve a normalized Java exception signature
    required: false
    default: "false"
  python-exception:
    description: Learn and preserve a normalized Python exception signature
    required: false
    default: "false"
  process-failure:
    description: Learn and preserve the exact process termination signature
    required: false
    default: "false"
  holdout-runs:
    description: Optional fresh samples used for final holdout certification
    required: false
    default: ""
  min-holdout-rate:
    description: Optional minimum one-sided holdout pass rate
    required: false
    default: ""
  holdout-confidence:
    description: Optional confidence level for holdout certification
    required: false
    default: ""
  ignore:
    description: Newline-separated exact file or directory basenames to exclude
    required: false
    default: ""
  ignore-path:
    description: Newline-separated exact repository-relative paths to exclude
    required: false
    default: ""
  keep:
    description: Newline-separated exact repository-relative paths to protect from file deletion
    required: false
    default: ""
  text-file:
    description: Newline-separated existing UTF-8 files to reduce by line
    required: false
    default: ""
  gitignore:
    description: Apply the repository .gitignore as an additional exclusion
    required: false
    default: "false"
  gitignore-recursive:
    description: Apply root and nested .gitignore files
    required: false
    default: "false"
  source:
    description: Repository-relative source directory
    required: false
    default: .
  output:
    description: Repository-relative output directory; empty uses runner temp
    required: false
    default: ""
  adapter:
    description: Structured manifest adapter (auto, none, maven, gradle, python, pipenv, node, composer, dotnet, ruby, cargo, or go)
    required: false
    default: auto
  source-reducer:
    description: Source reducer (auto, none, java, or python)
    required: false
    default: auto
  backend:
    description: Command execution backend (host or docker)
    required: false
    default: host
  docker-image:
    description: Existing local Docker image when backend is docker
    required: false
  docker-network:
    description: Docker network policy (none, bridge, or host)
    required: false
    default: none
  timeout:
    description: Maximum seconds for each reproduction command
    required: false
    default: "120"
  max-attempts:
    description: Optional maximum number of logical candidate attempts for the reduction
    required: false
    default: ""
  max-duration:
    description: Optional maximum total reduction duration in seconds
    required: false
    default: ""
  jobs:
    description: Candidate commands to run concurrently
    required: false
    default: "1"
  python-version:
    description: Python version used to install and run ReproMin; setup-python puts it first on PATH for the reproduction command
    required: false
    default: "3.13"
  artifact-name:
    description: Name of the uploaded GitHub Actions artifact
    required: false
    default: repomin-result
  step-summary:
    description: Append a privacy-safe validation summary to GITHUB_STEP_SUMMARY
    required: false
    default: "false"
runs:
  using: composite
  steps:
    - name: Set up Python
      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
      with:
        python-version: ${{ inputs.python-version }}
    - name: Install ReproMin
      shell: bash
      env:
        REPOMIN_ACTION_PATH: ${{ github.action_path }}
      run: python -m pip install --no-deps "$REPOMIN_ACTION_PATH"
    - name: Reduce failing repository
      id: reduce
      shell: bash
      env:
        REPOMIN_CONFIG: ${{ inputs.config }}
        REPOMIN_SOURCE: ${{ inputs.source }}
        REPOMIN_OUTPUT: ${{ inputs.output }}
        REPOMIN_COMMAND: ${{ inputs.command }}
        REPOMIN_MATCH: ${{ inputs.match }}
        REPOMIN_EXIT_CODE: ${{ inputs.exit-code }}
        REPOMIN_JAVA_EXCEPTION: ${{ inputs.java-exception }}
        REPOMIN_PYTHON_EXCEPTION: ${{ inputs.python-exception }}
        REPOMIN_PROCESS_FAILURE: ${{ inputs.process-failure }}
        REPOMIN_HOLDOUT_RUNS: ${{ inputs.holdout-runs }}
        REPOMIN_MIN_HOLDOUT_RATE: ${{ inputs.min-holdout-rate }}
        REPOMIN_HOLDOUT_CONFIDENCE: ${{ inputs.holdout-confidence }}
        REPOMIN_IGNORE: ${{ inputs.ignore }}
        REPOMIN_IGNORE_PATH: ${{ inputs.ignore-path }}
        REPOMIN_KEEP: ${{ inputs.keep }}
        REPOMIN_TEXT_FILE: ${{ inputs.text-file }}
        REPOMIN_GITIGNORE: ${{ inputs.gitignore }}
        REPOMIN_GITIGNORE_RECURSIVE: ${{ inputs.gitignore-recursive }}
        REPOMIN_ADAPTER: ${{ inputs.adapter }}
        REPOMIN_SOURCE_REDUCER: ${{ inputs.source-reducer }}
        REPOMIN_BACKEND: ${{ inputs.backend }}
        REPOMIN_DOCKER_IMAGE: ${{ inputs.docker-image }}
        REPOMIN_DOCKER_NETWORK: ${{ inputs.docker-network }}
        REPOMIN_TIMEOUT: ${{ inputs.timeout }}
        REPOMIN_MAX_ATTEMPTS: ${{ inputs.max-attempts }}
        REPOMIN_MAX_DURATION: ${{ inputs.max-duration }}
        REPOMIN_JOBS: ${{ inputs.jobs }}
        REPOMIN_STEP_SUMMARY: ${{ inputs.step-summary }}
      run: |
        set -euo pipefail

        resolve_workspace_path() {
          python - "$GITHUB_WORKSPACE" "$1" "$2" <<'PY'
        from pathlib import Path, PurePosixPath, PureWindowsPath
        import re
        import sys

        workspace = Path(sys.argv[1]).resolve()
        raw = sys.argv[2]
        label = sys.argv[3]
        components = [] if raw == "." and label == "source" else raw.split("/")
        unsafe_component = re.compile(r'[<>:"/\\|?*\[]|[\x00-\x1f]')
        windows_reserved_names = {
            "con",
            "prn",
            "aux",
            "nul",
            *(f"com{number}" for number in range(1, 10)),
            *(f"lpt{number}" for number in range(1, 10)),
        }
        invalid = (
            not raw
            or "\\" in raw
            or PurePosixPath(raw).is_absolute()
            or bool(PureWindowsPath(raw).drive)
            or any(part in {"", ".", ".."} for part in components)
            or any(
                unsafe_component.search(part)
                or part.endswith((" ", "."))
                or part.split(".", 1)[0].casefold() in windows_reserved_names
                for part in components
            )
        )
        if invalid:
            raise SystemExit(
                f"{label} must be a portable repository-relative path and must not escape the workspace"
            )

        candidate = workspace
        for part in components:
            candidate = candidate / part
            if candidate.is_symlink():
                raise SystemExit(f"{label} path must not contain symbolic links")
        try:
            resolved = candidate.resolve(strict=label in {"source", "config"})
            resolved.relative_to(workspace)
        except (OSError, RuntimeError, ValueError):
            raise SystemExit(f"{label} must resolve inside GITHUB_WORKSPACE")
        if label == "source" and not resolved.is_dir():
            raise SystemExit("source must resolve to a directory inside GITHUB_WORKSPACE")
        if label == "config":
            if not resolved.is_file():
                raise SystemExit(
                    "config must resolve to a readable regular file inside GITHUB_WORKSPACE"
                )
            try:
                with resolved.open("rb"):
                    pass
            except OSError:
                raise SystemExit(
                    "config must resolve to a readable regular file inside GITHUB_WORKSPACE"
                )
        print(resolved)
        PY
        }

        source_path="$(resolve_workspace_path "$REPOMIN_SOURCE" source)" || exit 2
        if [[ -n "$REPOMIN_OUTPUT" ]]; then
          output_path="$(resolve_workspace_path "$REPOMIN_OUTPUT" output)" || exit 2
        else
          if [[ -z "${RUNNER_TEMP:-}" ]]; then
            echo "RUNNER_TEMP is required when output is omitted" >&2
            exit 2
          fi
          output_path="$RUNNER_TEMP/repomin-result-${GITHUB_RUN_ID:-0}-${GITHUB_RUN_ATTEMPT:-0}-$$"
        fi
        case "$REPOMIN_STEP_SUMMARY" in
          true|false) ;;
          *)
            echo "step-summary must be true or false" >&2
            exit 2
            ;;
        esac
        args=(
          "$source_path"
          --output "$output_path"
        )
        if [[ -n "$REPOMIN_CONFIG" ]]; then
          config_conflicts=()
          record_config_conflict() {
            if [[ "$2" != "$3" ]]; then
              config_conflicts+=("$1")
            fi
          }
          record_config_conflict command "$REPOMIN_COMMAND" ""
          record_config_conflict match "$REPOMIN_MATCH" ""
          record_config_conflict exit-code "$REPOMIN_EXIT_CODE" ""
          record_config_conflict java-exception "$REPOMIN_JAVA_EXCEPTION" false
          record_config_conflict python-exception "$REPOMIN_PYTHON_EXCEPTION" false
          record_config_conflict process-failure "$REPOMIN_PROCESS_FAILURE" false
          record_config_conflict holdout-runs "$REPOMIN_HOLDOUT_RUNS" ""
          record_config_conflict min-holdout-rate "$REPOMIN_MIN_HOLDOUT_RATE" ""
          record_config_conflict holdout-confidence "$REPOMIN_HOLDOUT_CONFIDENCE" ""
          record_config_conflict ignore "$REPOMIN_IGNORE" ""
          record_config_conflict ignore-path "$REPOMIN_IGNORE_PATH" ""
          record_config_conflict keep "$REPOMIN_KEEP" ""
          record_config_conflict text-file "$REPOMIN_TEXT_FILE" ""
          record_config_conflict gitignore "$REPOMIN_GITIGNORE" false
          record_config_conflict gitignore-recursive "$REPOMIN_GITIGNORE_RECURSIVE" false
          record_config_conflict adapter "$REPOMIN_ADAPTER" auto
          record_config_conflict source-reducer "$REPOMIN_SOURCE_REDUCER" auto
          record_config_conflict backend "$REPOMIN_BACKEND" host
          record_config_conflict docker-image "$REPOMIN_DOCKER_IMAGE" ""
          record_config_conflict docker-network "$REPOMIN_DOCKER_NETWORK" none
          record_config_conflict timeout "$REPOMIN_TIMEOUT" 120
          record_config_conflict max-attempts "$REPOMIN_MAX_ATTEMPTS" ""
          record_config_conflict max-duration "$REPOMIN_MAX_DURATION" ""
          record_config_conflict jobs "$REPOMIN_JOBS" 1
          if (( ${#config_conflicts[@]} > 0 )); then
            printf 'config cannot be combined with non-default semantic inputs:' >&2
            printf ' %s' "${config_conflicts[@]}" >&2
            printf '\n' >&2
            exit 2
          fi
          config_path="$(resolve_workspace_path "$REPOMIN_CONFIG" config)" || exit 2
          args+=(--config "$config_path")
        else
          if [[ -z "${REPOMIN_COMMAND//[[:space:]]/}" ]]; then
            echo "command is required when config is omitted" >&2
            exit 2
          fi
          if [[ "$REPOMIN_BACKEND" == docker && -z "$REPOMIN_DOCKER_IMAGE" ]]; then
            echo "docker-image is required when backend is docker" >&2
            exit 2
          fi
          for signature_mode in \
            "java-exception:$REPOMIN_JAVA_EXCEPTION" \
            "python-exception:$REPOMIN_PYTHON_EXCEPTION" \
            "process-failure:$REPOMIN_PROCESS_FAILURE"
          do
            signature_name="${signature_mode%%:*}"
            signature_value="${signature_mode#*:}"
            case "$signature_value" in
              true|false) ;;
              *)
                echo "$signature_name must be true or false" >&2
                exit 2
                ;;
            esac
          done
          case "$REPOMIN_GITIGNORE" in
            true|false) ;;
            *)
              echo "gitignore must be true or false" >&2
              exit 2
              ;;
          esac
          case "$REPOMIN_GITIGNORE_RECURSIVE" in
            true|false) ;;
            *)
              echo "gitignore-recursive must be true or false" >&2
              exit 2
              ;;
          esac
          signature_mode_count=0
          for signature_value in \
            "$REPOMIN_JAVA_EXCEPTION" \
            "$REPOMIN_PYTHON_EXCEPTION" \
            "$REPOMIN_PROCESS_FAILURE"
          do
            if [[ "$signature_value" == true ]]; then
              signature_mode_count=$((signature_mode_count + 1))
            fi
          done
          if (( signature_mode_count > 1 )); then
            echo "only one of java-exception, python-exception, and process-failure may be true" >&2
            exit 2
          fi
          if [[ -z "$REPOMIN_MATCH" && -z "$REPOMIN_EXIT_CODE" && "$REPOMIN_PROCESS_FAILURE" != true ]]; then
            echo "set match, exit-code, or process-failure so the failure oracle is explicit" >&2
            exit 2
          fi
          if [[ -n "$REPOMIN_EXIT_CODE" && "$REPOMIN_PROCESS_FAILURE" == true ]]; then
            echo "exit-code cannot be combined with process-failure" >&2
            exit 2
          fi
          args+=(
            --command "$REPOMIN_COMMAND"
            --adapter "$REPOMIN_ADAPTER"
            --source-reducer "$REPOMIN_SOURCE_REDUCER"
            --backend "$REPOMIN_BACKEND"
            --docker-network "$REPOMIN_DOCKER_NETWORK"
            --timeout "$REPOMIN_TIMEOUT"
            --jobs "$REPOMIN_JOBS"
          )
          if [[ -n "$REPOMIN_MATCH" ]]; then
            args+=(--match "$REPOMIN_MATCH")
          fi
          if [[ -n "$REPOMIN_EXIT_CODE" ]]; then
            args+=(--exit-code "$REPOMIN_EXIT_CODE")
          fi
          if [[ "$REPOMIN_JAVA_EXCEPTION" == true ]]; then
            args+=(--java-exception)
          fi
          if [[ "$REPOMIN_PYTHON_EXCEPTION" == true ]]; then
            args+=(--python-exception)
          fi
          if [[ "$REPOMIN_PROCESS_FAILURE" == true ]]; then
            args+=(--process-failure)
          fi
          if [[ -n "$REPOMIN_HOLDOUT_RUNS" ]]; then
            args+=(--holdout-runs "$REPOMIN_HOLDOUT_RUNS")
          fi
          if [[ -n "$REPOMIN_MIN_HOLDOUT_RATE" ]]; then
            args+=(--min-holdout-rate "$REPOMIN_MIN_HOLDOUT_RATE")
          fi
          if [[ -n "$REPOMIN_HOLDOUT_CONFIDENCE" ]]; then
            args+=(--holdout-confidence "$REPOMIN_HOLDOUT_CONFIDENCE")
          fi
          append_repeated_option() {
            local option="$1"
            local values="$2"
            local value
            while IFS= read -r value; do
              value="${value%$'\r'}"
              [[ -z "$value" ]] && continue
              args+=("$option" "$value")
            done <<< "$values"
          }
          append_repeated_option --ignore "$REPOMIN_IGNORE"
          append_repeated_option --ignore-path "$REPOMIN_IGNORE_PATH"
          append_repeated_option --keep "$REPOMIN_KEEP"
          append_repeated_option --text-file "$REPOMIN_TEXT_FILE"
          if [[ -n "$REPOMIN_MAX_ATTEMPTS" ]]; then
            args+=(--max-attempts "$REPOMIN_MAX_ATTEMPTS")
          fi
          if [[ -n "$REPOMIN_MAX_DURATION" ]]; then
            args+=(--max-duration "$REPOMIN_MAX_DURATION")
          fi
          if [[ "$REPOMIN_GITIGNORE" == true ]]; then
            args+=(--gitignore)
          fi
          if [[ "$REPOMIN_GITIGNORE_RECURSIVE" == true ]]; then
            args+=(--gitignore-recursive)
          fi
          if [[ "$REPOMIN_BACKEND" == docker ]]; then
            args+=(--docker-image "$REPOMIN_DOCKER_IMAGE")
          fi
        fi
        repomin "${args[@]}"
        payload_path="$output_path"
        report_path="$payload_path.repomin/report.json"
        if [[ ! -d "$payload_path" || ! -f "$report_path" ]]; then
          echo "ReproMin did not produce the expected payload and report paths" >&2
          exit 1
        fi
        repomin report validate "$report_path" --payload "$payload_path" --json >/dev/null
        summary_path=""
        if [[ "$REPOMIN_STEP_SUMMARY" == true ]]; then
          if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
            summary_path="$GITHUB_STEP_SUMMARY"
            repomin report validate "$report_path" --payload "$payload_path" --format markdown >> "$summary_path"
            {
              printf '\n## ReproMin artifact\n\n'
              if [[ "${GITHUB_SERVER_URL:-}" =~ ^https://[A-Za-z0-9.-]+$ && "${GITHUB_REPOSITORY:-}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ && "${GITHUB_RUN_ID:-}" =~ ^[0-9]+$ ]]; then
                printf '[Open the workflow run to download the artifact](%s/%s/actions/runs/%s).\n' "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID"
              else
                printf 'The minimized payload and report are prepared for upload as the configured artifact.\n'
              fi
            } >> "$summary_path"
          else
            echo "step-summary requested but GITHUB_STEP_SUMMARY is unavailable; skipping" >&2
          fi
        fi
        {
          printf 'payload-path=%s\n' "$payload_path"
          printf 'report-path=%s\n' "$report_path"
          printf 'metadata-path=%s\n' "$payload_path.repomin"
          printf 'step-summary-path=%s\n' "$summary_path"
          python - "$report_path" "$payload_path" <<'PY'
        import json
        from pathlib import Path
        import sys

        with open(sys.argv[1], encoding="utf-8") as stream:
            report = json.load(stream)

        from repomin.cli import _validation_summary

        summary = _validation_summary(
            report,
            Path(sys.argv[1]),
            Path(sys.argv[2]),
        )
        required = {
            "report-schema-version": summary.get("schema_version"),
            "source-files": summary.get("source_files"),
            "source-bytes": summary.get("source_bytes"),
            "output-files": summary.get("output_files"),
            "output-bytes": summary.get("output_bytes"),
            "attempts": summary.get("attempts"),
            "accepted-mutations": summary.get("accepted_mutations"),
            "holdout-status": summary.get("holdout_status"),
        }
        if any(value is None for value in required.values()):
            raise SystemExit("generated report is missing an action output field")
        optional = {
            "oracle-mode": summary.get("oracle_mode"),
            "file-retention-ratio": summary.get("file_retention_ratio"),
            "byte-retention-ratio": summary.get("byte_retention_ratio"),
            "payload-fingerprint-mode": summary.get("payload_fingerprint_mode"),
            "payload-fingerprint-verified": summary.get("payload_fingerprint_verified"),
        }
        for name, value in {**required, **optional}.items():
            if isinstance(value, (dict, list)):
                raise SystemExit("generated report action output is not scalar: " + name)
            if isinstance(value, bool):
                value = str(value).lower()
            if value is None:
                value = ""
            print(f"{name}={value}")
        PY
        } >> "$GITHUB_OUTPUT"
    - name: Upload minimized reproduction
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
      with:
        name: ${{ inputs.artifact-name }}
        path: |
          ${{ steps.reduce.outputs.payload-path }}
          ${{ steps.reduce.outputs.metadata-path }}
        if-no-files-found: error
        include-hidden-files: true