architecture-guardian.yml

name: Architecture Guardian

# Run the continuous architecture guardian baseline daily and on manual
# dispatch. Emits Markdown + JSON reports as workflow artifacts; the JSON
# gate step is informational (continue-on-error) so the workflow does not
# fail on advisory findings — review the uploaded artifact instead.

on:
  workflow_dispatch:
  schedule:
    - cron: "0 6 * * *"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  guardian:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install roam-code
        run: |
          python -m pip install --upgrade pip
          pip install -e .

      - name: Build index
        run: roam init

      - name: Generate guardian markdown report
        run: |
          mkdir -p .roam/reports
          roam report guardian --md > .roam/reports/architecture_guardian.md

      - name: Run guardian gate (JSON)
        continue-on-error: true
        run: |
          roam --json report guardian > .roam/reports/architecture_guardian.json

      - name: Upload guardian artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: architecture-guardian
          path: .roam/reports/