action.yml

name: Devolv Action
description: Run Devolv DevOps Toolkit tools (drift, validate) in GitHub Actions

inputs:
  tool:
    description: Which Devolv tool to run (e.g. drift, validate)
    required: true
  policy-name:
    description: IAM policy name (required for drift)
    required: false
  path:
    description: Path to the local policy file or directory
    required: true
  github-token:
    description: GitHub token to use for API calls
    required: true
  fail-on-high-risk:
    description: Whether to fail the job if high-risk findings are detected (for validate)
    required: false
    default: "true"
  approvers:
    description: Comma-separated GitHub usernames for approval issue (optional)
    required: false
  approval-anyway:
    description: Force approval even if no drift detected
    required: false
    default: "false"

runs:
  using: "composite"
  steps:
    - name: Install Devolv silently
      run: |
        python -m pip install --quiet --disable-pip-version-check devolv==0.2.40
      shell: bash

    - name: Run Devolv tool
      run: |
        set -e

        export GITHUB_TOKEN="${{ inputs.github-token }}"

        if [ -z "${{ inputs.path }}" ]; then
          echo "::error::❌ Path input is required but was not provided."
          exit 1
        fi

        case "${{ inputs.tool }}" in
          drift)
            if [ ! -f "${{ inputs.path }}" ]; then
              echo "::error::❌ Drift requires a file path. '${{ inputs.path }}' is not a file."
              exit 1
            fi

            ARGS="--policy-name \"${{ inputs.policy-name }}\" --file \"${{ inputs.path }}\""
            if [ -n "${{ inputs.approvers }}" ]; then
              ARGS="$ARGS --approvers \"${{ inputs.approvers }}\""
            fi
            if [ "${{ inputs.approval-anyway }}" = "true" ]; then
              ARGS="$ARGS --approval-anyway"
            fi

            eval devolv drift $ARGS
            ;;
          
          validate)
            echo "::group::Running Devolv validate"
            if devolv validate "${{ inputs.path }}" --json | tee validate.json | grep -q '"level": "high"'; then
              cat validate.json
              echo "::error::❌ High-risk findings detected"
              exit 1
            else
              cat validate.json
              echo "✅ No high-risk findings."
            fi
            echo "::endgroup::"
            ;;
          
          *)
            echo "::error::❌ Unknown tool: '${{ inputs.tool }}'"
            exit 1
            ;;
        esac
      shell: bash

branding:
  icon: 'shield'
  color: 'blue'