audit.yml

name: Scheduled Audit

on:
  workflow_dispatch:
    inputs:
      username:
        description: GitHub username to audit
        required: false
        default: saagpatel

permissions:
  contents: read
  issues: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  audit:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[config]"

      - name: Restore previous audit history
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            output/audit-report-*.json
            output/history
            output/.audit-fingerprints.json
          key: audit-history-${{ github.repository }}
          restore-keys: audit-history-

      - name: Run audit
        env:
          GITHUB_TOKEN: ${{ secrets.AUDIT_TOKEN }}
        run: |
          mkdir -p output/history
          USERNAME="${{ github.event.inputs.username || 'saagpatel' }}"
          if ls output/audit-report-*.json >/dev/null 2>&1 && [ -f output/.audit-fingerprints.json ]; then
            audit "$USERNAME" --incremental --html --badges --diff --excel-mode standard
          else
            audit "$USERNAME" --html --badges --excel-mode standard
          fi

      - name: Build control-center artifact
        run: |
          USERNAME="${{ github.event.inputs.username || 'saagpatel' }}"
          audit "$USERNAME" --control-center

      - name: Inspect canonical scheduled handoff issue
        id: issue-state
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          USERNAME="${{ github.event.inputs.username || 'saagpatel' }}"
          TITLE="Scheduled Audit Handoff: $USERNAME"
          python3 - <<'PY'
          import json
          import os
          import subprocess

          title = os.environ["TITLE"]
          output_path = os.environ["GITHUB_OUTPUT"]
          items = json.loads(
              subprocess.check_output(
                  ["gh", "issue", "list", "--state", "all", "--limit", "100", "--json", "number,title,state,url"],
                  text=True,
              )
          )
          match = next((item for item in items if item.get("title") == title), None)
          state = "absent"
          number = ""
          url = ""
          if match:
              state = (match.get("state") or "").lower()
              number = str(match.get("number", ""))
              url = match.get("url", "")
          with open(output_path, "a", encoding="utf-8") as fh:
              fh.write(f"issue_state={state}\n")
              fh.write(f"issue_number={number}\n")
              fh.write(f"issue_url={url}\n")
          PY

      - name: Build scheduled handoff artifact
        run: |
          python3 -m src.scheduled_handoff \
            --output-dir output \
            --issue-state "${{ steps.issue-state.outputs.issue_state }}" \
            --issue-number "${{ steps.issue-state.outputs.issue_number }}" \
            --issue-url "${{ steps.issue-state.outputs.issue_url }}"

      - name: Read scheduled handoff decision
        id: scheduled-handoff
        run: |
          python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          path = sorted(Path("output").glob("scheduled-handoff-*.json"))[-1]
          payload = json.loads(path.read_text())
          issue = payload.get("issue_candidate", {})
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
              fh.write(f"action={issue.get('action', 'quiet')}\n")
              fh.write(f"issue_title={issue.get('title', '')}\n")
              fh.write(f"issue_label={issue.get('label', '')}\n")
              fh.write(f"body_path={issue.get('body_path', '')}\n")
              fh.write(f"issue_number={issue.get('issue_number', '')}\n")
              fh.write(f"reopen_existing={'true' if issue.get('reopen_existing') else 'false'}\n")
          PY

      - name: Apply scheduled handoff issue lifecycle
        if: steps.scheduled-handoff.outputs.action != 'quiet'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTION: ${{ steps.scheduled-handoff.outputs.action }}
          TITLE: ${{ steps.scheduled-handoff.outputs.issue_title }}
          LABEL: ${{ steps.scheduled-handoff.outputs.issue_label }}
          BODY_PATH: ${{ steps.scheduled-handoff.outputs.body_path }}
          ISSUE_NUMBER: ${{ steps.scheduled-handoff.outputs.issue_number }}
          REOPEN_EXISTING: ${{ steps.scheduled-handoff.outputs.reopen_existing }}
        run: |
          if ! gh label list --limit 200 --json name --jq '.[].name' | grep -qx "$LABEL"; then
            gh label create "$LABEL" --color "1D76DB" --description "Meaningful scheduled audit findings"
          fi
          if [ "$ACTION" = "open" ]; then
            gh issue create --title "$TITLE" --body-file "$BODY_PATH" --label "$LABEL"
          elif [ "$ACTION" = "update" ]; then
            if [ "$REOPEN_EXISTING" = "true" ] && [ -n "$ISSUE_NUMBER" ]; then
              gh issue reopen "$ISSUE_NUMBER"
            fi
            gh issue edit "$ISSUE_NUMBER" --body-file "$BODY_PATH" --add-label "$LABEL"
          elif [ "$ACTION" = "close" ]; then
            gh issue comment "$ISSUE_NUMBER" --body-file "$BODY_PATH"
            gh issue close "$ISSUE_NUMBER"
          fi

      - name: Save audit history
        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            output/audit-report-*.json
            output/history
            output/.audit-fingerprints.json
          key: audit-history-${{ github.repository }}-${{ github.run_number }}

      - name: Upload reports
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: audit-reports-${{ github.run_number }}
          path: output/
          retention-days: 90