action.yml

name: 'Warden'
description: 'Event-driven agent that analyzes GitHub PRs using Claude Code SDK'
author: 'Functional Software, Inc.'

branding:
  icon: 'shield'
  color: 'purple'

inputs:
  anthropic-api-key:
    description: 'Anthropic API key (sk-ant-...) or OAuth token. Can also be set via ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN env vars.'
    required: false
  github-token:
    description: 'GitHub token for API access (defaults to GITHUB_TOKEN)'
    required: false
    default: ${{ github.token }}
  mode:
    description: 'Action mode: analyze, report, or legacy run. analyze/report are pull request workflow only. Defaults to run for compatibility.'
    required: false
    default: 'run'
  findings-file:
    description: 'Path to structured JSON findings file to read in report mode.'
    required: false
  base-config-path:
    description: 'Path to the org-wide base warden.toml file to load before the repo config (relative to repo root)'
    required: false
  base-skill-root:
    description: 'Path to the checked-out org repo root for local shared skills used by the base config (relative to repo root)'
    required: false
  config-path:
    description: 'Path to the repo-local warden.toml config file that extends the base config in the same run (relative to repo root)'
    required: false
    default: 'warden.toml'
  fail-on:
    description: 'Minimum severity level to fail the action (off, critical, high, medium, low, info). Use "off" to never fail.'
    required: false
    default: 'high'
  report-on:
    description: 'Minimum severity level to show annotations in code review (off, critical, high, medium, low, info). Use "off" to disable reporting.'
    required: false
    default: 'medium'
  max-findings:
    description: 'Maximum number of findings to report (0 for unlimited)'
    required: false
    default: '50'
  request-changes:
    description: 'Whether to use REQUEST_CHANGES review event when findings exceed fail-on threshold'
    required: false
    default: 'false'
  fail-check:
    description: 'Whether to fail the check run when findings exceed fail-on threshold'
    required: false
    default: 'false'
  parallel:
    description: 'Maximum number of concurrent trigger executions'
    required: false
    default: '5'
  action-ref:
    description: 'The action ref that produced this run, surfaced in the findings output harness field'
    required: false
    default: ${{ github.action_ref }}
  service-url:
    description: 'Optional Warden service URL'
    required: false
  service-token:
    description: 'Warden service token. Store this value as a GitHub secret.'
    required: false
  service-data:
    description: 'Service data profile: metrics, findings, or code. Defaults to findings.'
    required: false
  service-memory:
    description: 'Enable repository memory. Defaults to true for findings/code and false for metrics.'
    required: false
  service-timeout-ms:
    description: 'Total deadline for each optional service request'
    required: false

outputs:
  findings-count:
    description: 'Total number of findings'
    value: ${{ steps.warden.outputs.findings-count }}
  high-count:
    description: 'Number of high severity findings'
    value: ${{ steps.warden.outputs.high-count }}
  summary:
    description: 'Summary of the analysis'
    value: ${{ steps.warden.outputs.summary }}
  findings-file:
    description: 'Path to structured JSON findings file (always written, use for upload to GCS/S3/etc.)'
    value: ${{ steps.warden.outputs.findings-file }}

runs:
  using: 'composite'
  steps:
    - name: Run Warden
      id: warden
      shell: bash
      env:
        INPUT_ANTHROPIC_API_KEY: ${{ inputs.anthropic-api-key }}
        INPUT_GITHUB_TOKEN: ${{ inputs.github-token }}
        INPUT_MODE: ${{ inputs.mode }}
        INPUT_FINDINGS_FILE: ${{ inputs.findings-file }}
        INPUT_BASE_CONFIG_PATH: ${{ inputs.base-config-path }}
        INPUT_BASE_SKILL_ROOT: ${{ inputs.base-skill-root }}
        INPUT_CONFIG_PATH: ${{ inputs.config-path }}
        INPUT_FAIL_ON: ${{ inputs.fail-on }}
        INPUT_REPORT_ON: ${{ inputs.report-on }}
        INPUT_MAX_FINDINGS: ${{ inputs.max-findings }}
        INPUT_REQUEST_CHANGES: ${{ inputs.request-changes }}
        INPUT_FAIL_CHECK: ${{ inputs.fail-check }}
        INPUT_PARALLEL: ${{ inputs.parallel }}
        INPUT_ACTION_REF: ${{ inputs.action-ref }}
        INPUT_SERVICE_URL: ${{ inputs.service-url }}
        INPUT_SERVICE_TOKEN: ${{ inputs.service-token }}
        INPUT_SERVICE_DATA: ${{ inputs.service-data }}
        INPUT_SERVICE_MEMORY: ${{ inputs.service-memory }}
        INPUT_SERVICE_TIMEOUT_MS: ${{ inputs.service-timeout-ms }}
      run: node ${{ github.action_path }}/dist/action/index.js