Gate AI-code defects before they merge

repos:
  - repo: https://github.com/shipmoor/shipmoor-pre-commit
    rev: v0.1.0
    hooks:
      - id: shipmoor-scan
        # optional: pin the CLI and the severity gate
        args: [--shipmoor-version=0.3.0, --fail-on, high]

name: shipmoor
on:
  pull_request:
permissions:
  contents: read
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # the diff needs history

      - name: Install Shipmoor CLI (pinned)
        env:
          SHIPMOOR_VERSION: "0.3.0"
          SHIPMOOR_NO_PATH_HINT: "1"
        run: |
          curl -fsSL https://dl.shipmoor.dev/install.sh | bash
          echo "$HOME/.shipmoor/bin" >> "$GITHUB_PATH"

      - name: Gate the change
        env:
          SHIPMOOR_TOKEN: ${{ secrets.SHIPMOOR_TOKEN }}
        run: |
          shipmoor scan \
            --diff "origin/${{ github.base_ref }}...HEAD" \
            --fail-on high --no-color

# Create this once on an authorized development machine.
shipmoor auth token create --name github-my-repo --scope scan

# Save the displayed secret as the repository secret SHIPMOOR_TOKEN.
# The workflow exposes it only to the Shipmoor Scan step.

name: "Shipmoor Gate"
description: >
  Runs the Shipmoor CLI against scan-path to catch AI-code-integrity
  defects (phantom imports, hallucinated APIs, stub paths, placeholder bodies).
  Installs the pinned CLI via the official installer, scans, and fails the
  build when a finding at or above `fail-on` severity is present. Always
  uploads SARIF 2.1.0 + a Markdown summary as artifacts. Set soft-fail: true
  for the measurement-only baseline run.

inputs:
  scan-path:
    description: "Directory to scan (e.g. services/realtime-listing-processor)"
    required: true
  token:
    description: "Scan-scoped Shipmoor machine token"
    required: true
  version:
    description: "Pinned Shipmoor CLI version (SHIPMOOR_VERSION)"
    required: false
    default: "0.3.0"
  fail-on:
    description: "Severity gate: none | medium | high | critical"
    required: false
    default: "high"
  config-file:
    description: "Path to .shipmoor.yaml relative to scan-path"
    required: false
    default: ".shipmoor.yaml"
  soft-fail:
    description: "Report findings without failing the job (true/false)"
    required: false
    default: "false"
  diff-base:
    description: >
      When set, gate only findings introduced relative to this git ref by
      running `shipmoor scan --diff <diff-base>...HEAD` (honours
      .shipmoor.yaml `diff.only_introduced`). Leave empty for a full-tree scan.
      Typically the PR base SHA: pre-existing debt must not block.
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Install Shipmoor CLI (pinned)
      shell: bash
      env:
        SHIPMOOR_VERSION: ${{ inputs.version }}
        SHIPMOOR_NO_PATH_HINT: "1"
      run: |
        curl -fsSL https://dl.shipmoor.dev/install.sh | bash
        echo "$HOME/.shipmoor/bin" >> "$GITHUB_PATH"

    - name: Show Shipmoor version
      shell: bash
      run: shipmoor version

    - name: Resolve artifact suffix
      id: name
      shell: bash
      run: |
        SAFE="$(echo "${{ inputs.scan-path }}" | tr '/ ' '--')"
        echo "suffix=$SAFE" >> "$GITHUB_OUTPUT"

    - name: Run Shipmoor scan
      shell: bash
      working-directory: ${{ inputs.scan-path }}
      env:
        SHIPMOOR_TOKEN: ${{ inputs.token }}
      run: |
        SARIF="$RUNNER_TEMP/shipmoor-${{ steps.name.outputs.suffix }}.sarif"
        SUMMARY="$RUNNER_TEMP/shipmoor-${{ steps.name.outputs.suffix }}.md"

        # In soft-fail (baseline) mode the gate never blocks, so scan with
        # --fail-on none; otherwise honour the requested severity threshold.
        if [ "${{ inputs.soft-fail }}" = "true" ]; then
          FAIL_ON="none"
        else
          FAIL_ON="${{ inputs.fail-on }}"
        fi

        # Prefer the per-package config, fall back to the repo-root config,
        # otherwise let Shipmoor auto-discover.
        CONFIG_ARG=""
        if [ -f "${{ inputs.config-file }}" ]; then
          CONFIG_ARG="--config ${{ inputs.config-file }}"
        elif [ -f "$GITHUB_WORKSPACE/.shipmoor.yaml" ]; then
          CONFIG_ARG="--config $GITHUB_WORKSPACE/.shipmoor.yaml"
        fi

        # When a diff base is supplied, gate only findings introduced by the
        # change (legacy debt must not block migrations). Empty => full scan.
        DIFF_ARG=""
        if [ -n "${{ inputs.diff-base }}" ]; then
          DIFF_ARG="--diff ${{ inputs.diff-base }}...HEAD"
          echo "Shipmoor diff scope: ${{ inputs.diff-base }}...HEAD"
        else
          echo "Shipmoor scope: full tree"
        fi

        EXIT=0
        shipmoor scan . \
          --sarif --output "$SARIF" \
          --markdown-summary "$SUMMARY" \
          --fail-on "$FAIL_ON" \
          --no-color \
          $DIFF_ARG \
          $CONFIG_ARG || EXIT=$?

        if [ "${{ inputs.soft-fail }}" = "true" ]; then
          echo "soft-fail mode: shipmoor exit was ${EXIT}, not failing the job"
          exit 0
        fi
        exit "${EXIT}"

    - name: Upload Shipmoor report
      if: always()
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: shipmoor-report-${{ steps.name.outputs.suffix }}
        path: |
          ${{ runner.temp }}/shipmoor-${{ steps.name.outputs.suffix }}.sarif
          ${{ runner.temp }}/shipmoor-${{ steps.name.outputs.suffix }}.md
        if-no-files-found: warn