action.yml

name: Skilldrift — Skills Drift Monitor
description: Detect upstream drift in installed Claude Code Skills and open GitHub Issues with SkillSpector risk re-scoring.
author: kpab

branding:
  icon: shield
  color: orange

inputs:
  dir:
    description: Directory containing skilldrift.lock (relative to the repo root)
    default: "."
  create-issue:
    description: Whether to create/update a GitHub Issue when drift is detected
    default: "true"
  issue-repo:
    description: Repository to open Issues in (owner/name)
    default: ${{ github.repository }}
  token:
    description: "GitHub API token (used to fetch upstream and create Issues; Issue creation needs issues: write permission)"
    default: ${{ github.token }}
  fail-on-drift:
    description: Whether to fail the step when drift is detected (leave "false" if Issue notification is enough)
    default: "false"
  scan-risk:
    description: Whether to re-score old/new risk with SkillSpector on drift and include the comparison in the Issue
    default: "true"
  version:
    description: skilldrift version to use (e.g. "v0.1.0"). Defaults to the action ref, or the latest release if the ref is not a version
    default: ""

outputs:
  drifted:
    description: Whether drift was detected ("true" / "false")
    value: ${{ steps.check.outputs.drifted }}

runs:
  using: composite
  steps:
    # GitHub Releases のバイナリをDLして使う(goreleaserが命名した
    # skilldrift_<goos>_<goarch>.tar.gz を取得)。
    # バージョンは version 入力 > actionのref(vX.Y.Z形式のとき) > 最新release の順で決める。
    - id: download
      shell: bash
      env:
        INPUT_VERSION: ${{ inputs.version }}
        ACTION_REF: ${{ github.action_ref }}
      run: |
        os=$(uname -s | tr '[:upper:]' '[:lower:]')
        arch=$(uname -m)
        case "$arch" in
          x86_64|amd64) arch=amd64 ;;
          aarch64|arm64) arch=arm64 ;;
          *) echo "unsupported architecture: $arch" >&2; exit 1 ;;
        esac

        ver="$INPUT_VERSION"
        if [ -z "$ver" ]; then
          case "$ACTION_REF" in
            v[0-9]*) ver="$ACTION_REF" ;;   # vX.Y.Z でピンされていればそのrelease
            *)       ver="latest" ;;         # main等ブランチ参照なら最新release
          esac
        fi

        asset="skilldrift_${os}_${arch}.tar.gz"
        if [ "$ver" = "latest" ]; then
          url="https://github.com/kpab/skilldrift/releases/latest/download/${asset}"
        else
          url="https://github.com/kpab/skilldrift/releases/download/${ver}/${asset}"
        fi

        echo "downloading skilldrift ${ver} (${os}/${arch}): $url"
        if ! curl -fsSL "$url" -o "$RUNNER_TEMP/skilldrift.tar.gz"; then
          echo "failed to download the release binary ($url). Check the version input or the action ref" >&2
          exit 1
        fi
        tar -xzf "$RUNNER_TEMP/skilldrift.tar.gz" -C "$RUNNER_TEMP" skilldrift
        chmod +x "$RUNNER_TEMP/skilldrift"

    # リスク再評価に使う外部スキャナー。scan-risk が false ならスキップし、
    # skilldrift 側も skillspector 不在を検知して自動でリスク評価を飛ばす。
    - if: inputs.scan-risk == 'true'
      uses: astral-sh/setup-uv@v5

    - if: inputs.scan-risk == 'true'
      shell: bash
      run: |
        uv tool install "git+https://github.com/NVIDIA/skillspector.git"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

    - id: check
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.token }}
        INPUT_DIR: ${{ inputs.dir }}
        INPUT_CREATE_ISSUE: ${{ inputs.create-issue }}
        INPUT_ISSUE_REPO: ${{ inputs.issue-repo }}
        INPUT_FAIL_ON_DRIFT: ${{ inputs.fail-on-drift }}
        INPUT_SCAN_RISK: ${{ inputs.scan-risk }}
      run: |
        args=(check -dir "$INPUT_DIR")
        if [ "$INPUT_CREATE_ISSUE" = "true" ]; then
          args+=(-issue -issue-repo "$INPUT_ISSUE_REPO")
        fi
        if [ "$INPUT_SCAN_RISK" != "true" ]; then
          args+=(-scan=false)
        fi

        set +e
        "$RUNNER_TEMP/skilldrift" "${args[@]}"
        code=$?
        set -e

        case "$code" in
          0) echo "drifted=false" >> "$GITHUB_OUTPUT" ;;
          1) echo "drifted=true" >> "$GITHUB_OUTPUT"
             if [ "$INPUT_FAIL_ON_DRIFT" = "true" ]; then
               exit 1
             fi ;;
          *) exit "$code" ;;
        esac