action.yml

name: "Tempo Lints"
description: "Run Tempo lint rules on your codebase"
author: "Tempo Labs"

branding:
  icon: "check-circle"
  color: "purple"

inputs:
  language:
    description: "Language to lint: rust, typescript, or all"
    required: true
  path:
    description: "Path to scan (defaults to current directory)"
    required: false
    default: "."
  fail-on-error:
    description: "Fail the action if lint errors are found"
    required: false
    default: "true"
  exclude-rules:
    description: 'Comma-separated list of rule IDs to exclude (e.g., "no-dbg-macro,no-console-log")'
    required: false
    default: ""
  fix:
    description: "Apply auto-fixes where available"
    required: false
    default: "false"
  post-comment:
    description: "Post lint results as a PR comment"
    required: false
    default: "false"
  github-token:
    description: "GitHub token for posting PR comments (required if post-comment is true)"
    required: false
    default: ""

outputs:
  has-errors:
    description: "Whether any error-level issues were found"
    value: ${{ steps.run-lint.outputs.has_errors }}

runs:
  using: "composite"
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
      with:
        node-version: "lts/*"

    - name: Enable corepack
      shell: bash
      run: corepack enable

    - name: Get cache keys
      id: cache-keys
      shell: bash
      run: |
        echo "PNPM_STORE=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
        # Hash the lockfile for cache key
        LOCK_HASH=$(sha256sum "${{ github.action_path }}/pnpm-lock.yaml" | cut -d' ' -f1 | head -c 16)
        echo "LOCK_HASH=$LOCK_HASH" >> $GITHUB_OUTPUT

    - name: Cache pnpm store
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ${{ steps.cache-keys.outputs.PNPM_STORE }}
        key: tempo-lints-pnpm-store-${{ runner.os }}-${{ steps.cache-keys.outputs.LOCK_HASH }}
        restore-keys: |
          tempo-lints-pnpm-store-${{ runner.os }}-

    - name: Cache node_modules (includes sg binary)
      id: cache-node-modules
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ${{ github.action_path }}/node_modules
        key: tempo-lints-node-modules-${{ runner.os }}-${{ steps.cache-keys.outputs.LOCK_HASH }}

    - name: Install tempo-lints dependencies
      if: steps.cache-node-modules.outputs.cache-hit != 'true'
      shell: bash
      run: cd "${{ github.action_path }}" && pnpm install --frozen-lockfile

    - name: Run Tempo Lints
      id: run-lint
      shell: bash
      working-directory: ${{ github.workspace }}
      run: |
        # Resolve scan path (default to workspace root)
        SCAN_PATH="${{ inputs.path }}"
        if [ "$SCAN_PATH" = "." ]; then
          SCAN_PATH="${{ github.workspace }}"
        fi

        # Build CLI args - use JSON output if PR comment is needed
        if [ "${{ inputs.post-comment }}" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then
          OUTPUT_FORMAT="--json"
        else
          OUTPUT_FORMAT="--github-action"
        fi

        # Build CLI args array for safe parameter passing
        CLI_ARGS=("${{ inputs.language }}" "$SCAN_PATH" "$OUTPUT_FORMAT")

        if [ -n "${{ inputs.exclude-rules }}" ]; then
          CLI_ARGS+=("--exclude" "${{ inputs.exclude-rules }}")
        fi

        if [ "${{ inputs.fix }}" = "true" ]; then
          CLI_ARGS+=("--fix")
        fi

        # Debug: show what we're scanning
        echo "Scanning: $SCAN_PATH"
        echo "CLI args: ${CLI_ARGS[*]}"

        # Run lint and capture output
        OUTPUT_FILE="${{ runner.temp }}/tempo-lints-output.json"
        set +e
        if [ "$OUTPUT_FORMAT" = "--json" ]; then
          pnpm --dir "${{ github.action_path }}" exec tsx "${{ github.action_path }}/bin/tempo-lints.ts" "${CLI_ARGS[@]}" > "$OUTPUT_FILE" 2>/dev/null
        else
          pnpm --dir "${{ github.action_path }}" exec tsx "${{ github.action_path }}/bin/tempo-lints.ts" "${CLI_ARGS[@]}"
        fi
        EXIT_CODE=$?
        set -e

        # Set outputs based on exit code
        HAS_ERRORS="false"
        if [ "$EXIT_CODE" != "0" ]; then
          HAS_ERRORS="true"
        fi

        echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
        echo "has_errors=$HAS_ERRORS" >> $GITHUB_OUTPUT

        # Only set output_file when using JSON format
        if [ "$OUTPUT_FORMAT" = "--json" ]; then
          echo "output_file=$OUTPUT_FILE" >> $GITHUB_OUTPUT
        fi

    - name: Post PR comment
      if: inputs.post-comment == 'true' && github.event_name == 'pull_request'
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
      run: |
        if [ -z "$GITHUB_TOKEN" ]; then
          echo "::warning::github-token is required for posting PR comments"
          exit 0
        fi

        OUTPUT_FILE="${{ steps.run-lint.outputs.output_file }}"

        # Validate output file exists
        if [ ! -f "$OUTPUT_FILE" ]; then
          echo "::error::Output file not found at $OUTPUT_FILE"
          exit 1
        fi

        # Count issues from JSON output
        TOTAL_ISSUES=$(node -p "try { JSON.parse(require('fs').readFileSync('$OUTPUT_FILE','utf8')).length } catch { 0 }" 2>/dev/null || echo "0")

        pnpm --dir "${{ github.action_path }}" exec tsx "${{ github.action_path }}/scripts/post-pr-comment.ts" \
          "$OUTPUT_FILE" \
          "$TOTAL_ISSUES" \
          "${{ github.repository }}" \
          "${{ github.event.pull_request.number }}" \
          "${{ inputs.language }}"

    - name: Check for failures
      if: inputs.fail-on-error == 'true'
      shell: bash
      run: |
        EXIT_CODE="${{ steps.run-lint.outputs.exit_code }}"
        if [ "$EXIT_CODE" != "0" ]; then
          echo "::error::Lint errors found. Fix the issues above or set fail-on-error to false."
          exit 1
        fi