zeroclaw/.github/workflows/ci-change-audit.yml

name: CI/CD Change Audit

# Moved off PR path per CI/CD optimization PRD.
# Audit trail runs on push-to-main/dev only.
on:
    push:
        branches: [dev, main]
        paths:
            - ".github/workflows/**"
            - ".github/release/**"
            - ".github/codeql/**"
            - "scripts/ci/**"
            - ".github/dependabot.yml"
            - "deny.toml"
            - ".gitleaks.toml"
    workflow_dispatch:
        inputs:
            base_sha:
                description: "Optional base SHA (default: HEAD~1)"
                required: false
                default: ""
                type: string
            fail_on_policy:
                description: "Fail when audit policy violations are found"
                required: true
                default: true
                type: boolean

concurrency:
    group: ci-change-audit-${{ github.sha || github.run_id }}
    cancel-in-progress: true

permissions:
    contents: read

env:
    GIT_CONFIG_COUNT: "1"
    GIT_CONFIG_KEY_0: core.hooksPath
    GIT_CONFIG_VALUE_0: /dev/null


jobs:
    audit:
        name: CI Change Audit
        runs-on: [self-hosted, Linux, X64, aws-india, light, cpu40]
        timeout-minutes: 15
        steps:
            - name: Checkout
              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
              with:
                  fetch-depth: 0

            - name: Setup Python
              shell: bash
              run: |
                  set -euo pipefail
                  python3 --version                  

            - name: Resolve base/head commits
              id: refs
              shell: bash
              run: |
                  set -euo pipefail
                  head_sha="$(git rev-parse HEAD)"
                  if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
                    # For pull_request events, checkout uses refs/pull/*/merge; HEAD^1 is the
                    # effective base commit for this synthesized merge and avoids stale base.sha.
                    if git rev-parse --verify HEAD^1 >/dev/null 2>&1; then
                      base_sha="$(git rev-parse HEAD^1)"
                    else
                      base_sha="${{ github.event.pull_request.base.sha }}"
                    fi
                  elif [ "${GITHUB_EVENT_NAME}" = "push" ]; then
                    base_sha="${{ github.event.before }}"
                  else
                    base_sha="${{ github.event.inputs.base_sha || '' }}"
                    if [ -z "$base_sha" ]; then
                      base_sha="$(git rev-parse HEAD~1)"
                    fi
                  fi
                  echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
                  echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"                  

            - name: Run CI helper script unit tests
              shell: bash
              run: |
                  set -euo pipefail
                  python3 -m unittest discover -s scripts/ci/tests -p 'test_*.py' -v                  

            - name: Generate CI change audit
              shell: bash
              env:
                  BASE_SHA: ${{ steps.refs.outputs.base_sha }}
                  HEAD_SHA: ${{ steps.refs.outputs.head_sha }}
              run: |
                  set -euo pipefail
                  mkdir -p artifacts
                  fail_on_policy="true"
                  if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
                    fail_on_policy="${{ github.event.inputs.fail_on_policy || 'true' }}"
                  fi
                  cmd=(python3 scripts/ci/ci_change_audit.py
                    --base-sha "$BASE_SHA"
                    --head-sha "$HEAD_SHA"
                    --output-json artifacts/ci-change-audit.json
                    --output-md artifacts/ci-change-audit.md)
                  if [ "$fail_on_policy" = "true" ]; then
                    cmd+=(--fail-on-violations)
                  fi
                  "${cmd[@]}"                  

            - name: Emit normalized audit event
              if: always()
              shell: bash
              run: |
                  set -euo pipefail
                  if [ -f artifacts/ci-change-audit.json ]; then
                    python3 scripts/ci/emit_audit_event.py \
                      --event-type ci_change_audit \
                      --input-json artifacts/ci-change-audit.json \
                      --output-json artifacts/audit-event-ci-change-audit.json \
                      --artifact-name ci-change-audit-event \
                      --retention-days 14
                  fi                  

            - name: Upload audit artifact
              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
              if: always()
              with:
                  name: ci-change-audit
                  path: artifacts/ci-change-audit.*
                  retention-days: 14

            - name: Publish audit summary
              if: always()
              shell: bash
              run: |
                  set -euo pipefail
                  if [ -f artifacts/ci-change-audit.md ]; then
                    cat artifacts/ci-change-audit.md >> "$GITHUB_STEP_SUMMARY"
                  else
                    echo "CI change audit report was not generated." >> "$GITHUB_STEP_SUMMARY"
                  fi                  

            - name: Upload audit event artifact
              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
              if: always()
              with:
                  name: ci-change-audit-event
                  path: artifacts/audit-event-ci-change-audit.json
                  if-no-files-found: ignore
                  retention-days: 14