copilot-setup-steps.yml

name: "Copilot Setup Steps"

on:
  workflow_dispatch:
  push:
    paths:
      - .github/workflows/copilot-setup-steps.yml
  pull_request:
    paths:
      - .github/workflows/copilot-setup-steps.yml

jobs:
  # This job name is required by GitHub Copilot repository agent.
  copilot-setup-steps:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Detect Ito CLI
        run: |
          if command -v ito >/dev/null 2>&1; then
            echo "ITO_AVAILABLE=1" >> "$GITHUB_ENV"
          else
            echo "::warning::Ito CLI not found on PATH; skipping Ito audit checks in copilot-setup-steps."
            echo "ITO_AVAILABLE=0" >> "$GITHUB_ENV"
          fi

      - name: Validate Ito audit log
        if: env.ITO_AVAILABLE == '1'
        run: |
          if ! ito audit validate; then
            echo "::error::Ito audit validation failed before GitHub Copilot agent startup."
            echo "::error::Run 'ito audit validate' for details and 'ito audit reconcile --fix' if drift must be repaired."
            exit 1
          fi

      - name: Check Ito audit drift
        if: env.ITO_AVAILABLE == '1'
        run: |
          if ! ito audit reconcile; then
            echo "::warning::Ito audit drift detected. Run 'ito audit reconcile --fix' to write compensating audit events."
          fi