github-action.yml

# ProofGate as a required PR check.
#
# Drop this in .github/workflows/proofgate.yml. With branch protection requiring
# the "proofgate" check, a PR cannot merge while a blocker is open. The findings
# are written to the job summary, so reviewers see them without any app install.
name: ProofGate

on:
  pull_request:

permissions:
  contents: read

jobs:
  proofgate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # full history so base...head diff resolves

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install ProofGate
        run: npm install -g proofgate

      # Verify the PR against its own description. Exit code is non-zero when a
      # blocker is found, which fails the check and blocks the merge.
      - name: Run ProofGate
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: |
          proofgate run \
            --base "origin/${{ github.base_ref }}" \
            --head HEAD \
            --pr-body "$PR_BODY" \
            --format markdown | tee -a "$GITHUB_STEP_SUMMARY"