action.yml

name: Qualify packaged Kafkars
description: Package Kafkars and run a fail-closed testlab qualification against real Kafka.

inputs:
  kafkars-path:
    description: Path to the checked-out Kafkars repository.
    required: true
  qualification:
    description: Pull-request or release qualification tier.
    required: false
    default: pr
  evidence-directory:
    description: Directory that receives sealed qualification evidence.
    required: false
    default: testlab-evidence
  cell:
    description: Optional exact qualification cell; produces a shard, not a full release verdict.
    required: false
    default: ""
  allow-dirty:
    description: Permit a dirty Kafkars worktree when explicitly set to true.
    required: false
    default: "false"

outputs:
  evidence-directory:
    description: Absolute directory containing the sealed evidence.
    value: ${{ steps.qualify.outputs.evidence-directory }}

runs:
  using: composite
  steps:
    - name: Validate qualification runner
      shell: bash
      run: |
        set -euo pipefail
        if [[ "${RUNNER_OS:-}" != "Linux" ]]; then
          echo "testlab qualification requires a Linux runner" >&2
          exit 2
        fi
        command -v apt-get >/dev/null
        command -v docker >/dev/null
        command -v rustup >/dev/null
        docker compose version
        docker info >/dev/null

    - name: Install native build dependencies
      shell: bash
      run: |
        set -euo pipefail
        sudo apt-get update
        sudo apt-get install --yes --no-install-recommends libcurl4-openssl-dev

    - name: Install pinned Rust toolchains
      shell: bash
      run: |
        rustup toolchain install 1.88.0 --profile minimal
        rustup toolchain install 1.90.0 --profile minimal

    - id: qualify
      name: Package and qualify Kafkars
      shell: bash
      env:
        INPUT_KAFKARS_PATH: ${{ inputs.kafkars-path }}
        INPUT_QUALIFICATION: ${{ inputs.qualification }}
        INPUT_EVIDENCE_DIRECTORY: ${{ inputs.evidence-directory }}
        INPUT_ALLOW_DIRTY: ${{ inputs.allow-dirty }}
        TESTLAB_QUALIFICATION_CELL: ${{ inputs.cell }}
      run: |
        set -euo pipefail

        case "$INPUT_KAFKARS_PATH" in
          /*) kafkars_path="$INPUT_KAFKARS_PATH" ;;
          *) kafkars_path="$GITHUB_WORKSPACE/$INPUT_KAFKARS_PATH" ;;
        esac
        case "$INPUT_EVIDENCE_DIRECTORY" in
          /*) evidence_directory="$INPUT_EVIDENCE_DIRECTORY" ;;
          *) evidence_directory="$GITHUB_WORKSPACE/$INPUT_EVIDENCE_DIRECTORY" ;;
        esac
        case "$INPUT_ALLOW_DIRTY" in
          false) dirty_argument=() ;;
          true) dirty_argument=(--allow-dirty) ;;
          *)
            echo "allow-dirty must be true or false" >&2
            exit 2
            ;;
        esac

        echo "evidence-directory=$evidence_directory" >> "$GITHUB_OUTPUT"
        TESTLAB_EVIDENCE_DIR="$evidence_directory" \
          "$GITHUB_ACTION_PATH/scripts/qualify-kafkars-candidate" \
          "$kafkars_path" "$INPUT_QUALIFICATION" "${dirty_argument[@]}"