action.yml

name: "django-orm-lens"
# Marketplace requires the description to stay under 125 characters.
description: >-
  Static Django schema gates for CI: N+1 detection, migration risk flags,
  schema diffs. No DB, no Django boot.
author: "FROWNINGdev"
branding:
  icon: "layers"
  color: "green"

inputs:
  command:
    description: >-
      Subcommand to run: nplusone | migration-risk | blast-radius | impact |
      scan | list | er | diff | suggest-indexes | signals | migration-deps |
      cascade | drift | stats-sql
    required: false
    default: "nplusone"
  path:
    description: "Workspace root to analyze"
    required: false
    default: "."
  format:
    description: >-
      Output format for nplusone / migration-risk / blast-radius. "github"
      prints workflow commands that become PR annotations with zero extra
      permissions; "sarif" pairs with github/codeql-action/upload-sarif for
      the Security tab; "markdown" (blast-radius only) prints a PR-comment
      body you can pipe into `gh pr comment`. Other commands keep their own
      default format.
    required: false
    default: "github"
  args:
    description: "Extra CLI arguments appended verbatim (e.g. --severity all)"
    required: false
    default: ""
  version:
    description: "django-orm-lens version to install from PyPI (default: latest)"
    required: false
    default: ""
  install:
    description: >-
      Install django-orm-lens from PyPI before running. Set to "false" when the
      workflow has already put a build on PATH — a checkout of this repo, or a
      wheel from an earlier job. Note that a PyPI install can only ever expose
      commands that have been released, so an unreleased command needs this off
      plus your own install step.
    required: false
    default: "true"
  only-changed:
    description: >-
      blast-radius only. Restrict the report to migration files this pull
      request touches, instead of every migration in the workspace. Needs
      github-token. Ignored outside pull_request events.
    required: false
    default: "false"
  comment:
    description: >-
      blast-radius only. Post the markdown report as a pull-request comment,
      updating the previous one in place rather than adding a new comment on
      every push. Needs github-token and `permissions: pull-requests: write`.
    required: false
    default: "false"
  github-token:
    description: >-
      Token for only-changed / comment. The built-in workflow token is
      enough; it needs `pull-requests: write` only when comment is enabled.
      NOTE: no expression syntax anywhere in this file outside `runs:` —
      GitHub evaluates it while loading the manifest, and an unavailable
      context there fails the whole action, not just the input.
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    # Inputs are passed via env, never interpolated into the script body —
    # ${{ }} inside run: is literal text substitution and a script-injection
    # vector the moment a caller wires an input from untrusted data.
    - name: Install django-orm-lens
      shell: bash
      env:
        DOL_VERSION: ${{ inputs.version }}
        DOL_INSTALL: ${{ inputs.install }}
      run: |
        if [ "$DOL_INSTALL" != "true" ]; then
          echo "install: skipped by input"
          command -v django-orm-lens >/dev/null 2>&1 || {
            echo "::error::install is false but django-orm-lens is not on PATH"
            exit 1
          }
          exit 0
        fi
        if command -v python3 >/dev/null 2>&1; then PY=python3; else PY=python; fi
        if [ -n "$DOL_VERSION" ]; then
          "$PY" -m pip install --quiet "django-orm-lens==$DOL_VERSION"
        else
          "$PY" -m pip install --quiet django-orm-lens
        fi

    - name: Run django-orm-lens ${{ inputs.command }}
      shell: bash
      env:
        DOL_COMMAND: ${{ inputs.command }}
        DOL_PATH: ${{ inputs.path }}
        DOL_FORMAT: ${{ inputs.format }}
        DOL_ARGS: ${{ inputs.args }}
        DOL_ONLY_CHANGED: ${{ inputs.only-changed }}
        DOL_COMMENT: ${{ inputs.comment }}
        DOL_REPO: ${{ github.repository }}
        DOL_PR: ${{ github.event.pull_request.number }}
        GH_TOKEN: ${{ inputs.github-token }}
      run: |
        FORMAT_ARGS=""
        case "$DOL_COMMAND" in
          nplusone|n-plus-one|migration-risk|blast-radius|blast)
            FORMAT_ARGS="--format $DOL_FORMAT"
            ;;
        esac

        IS_BLAST=false
        case "$DOL_COMMAND" in
          blast-radius|blast) IS_BLAST=true ;;
        esac

        # --- only-changed: scope the report to this PR's migrations ---------
        # The PR file list comes from the API rather than `git diff`, because
        # actions/checkout defaults to depth 1 and the base commit is simply
        # not in the local history.
        ONLY_ARGS=""
        if [ "$DOL_ONLY_CHANGED" = "true" ] && [ "$IS_BLAST" = true ]; then
          if [ -z "${DOL_PR:-}" ]; then
            echo "::notice::only-changed ignored — not a pull_request event"
          elif [ -z "${GH_TOKEN:-}" ]; then
            echo "::error::only-changed needs github-token"; exit 1
          else
            CHANGED=$(gh api "repos/$DOL_REPO/pulls/$DOL_PR/files" --paginate \
              --jq '.[] | select(.status != "removed") | .filename' \
              | grep -E '(^|/)migrations/[^/]+\.py$' || true)
            if [ -z "$CHANGED" ]; then
              echo "::notice::no migration files changed in this PR — nothing to review"
              exit 0
            fi
            while IFS= read -r f; do
              [ -n "$f" ] && ONLY_ARGS="$ONLY_ARGS --only $f"
            done <<< "$CHANGED"
          fi
        fi

        # --- run ------------------------------------------------------------
        # DOL_ARGS and ONLY_ARGS are intentionally word-split: they carry flags.
        if [ "$DOL_COMMENT" = "true" ] && [ "$IS_BLAST" = true ]; then
          REPORT="$RUNNER_TEMP/django-orm-lens-blast-radius.md"
          RC=0
          django-orm-lens "$DOL_COMMAND" --path "$DOL_PATH" --format markdown \
            $ONLY_ARGS $DOL_ARGS > "$REPORT" || RC=$?
          cat "$REPORT"

          if [ ! -s "$REPORT" ]; then
            # An empty body is a 422 from the API, which would mask whatever
            # actually went wrong upstream. Surface that instead.
            echo "::error::blast-radius produced no report (exit $RC) - not commenting"
            exit "${RC:-1}"
          fi
          if [ -z "${DOL_PR:-}" ]; then
            echo "::notice::comment skipped — not a pull_request event"
          elif [ -z "${GH_TOKEN:-}" ]; then
            echo "::error::comment needs github-token"; exit 1
          else
            # Reuse our own previous comment so a 20-push PR keeps one report,
            # not twenty. The marker is the first line of the rendered report.
            EXISTING=$(gh api "repos/$DOL_REPO/issues/$DOL_PR/comments" --paginate \
              --jq '.[] | select(.body | startswith("<!-- django-orm-lens: blast-radius -->")) | .id' \
              | head -n 1 || true)
            if [ -n "$EXISTING" ]; then
              gh api -X PATCH "repos/$DOL_REPO/issues/comments/$EXISTING" \
                -F body=@"$REPORT" --silent
            else
              gh api -X POST "repos/$DOL_REPO/issues/$DOL_PR/comments" \
                -F body=@"$REPORT" --silent
            fi
          fi
          exit $RC
        fi

        django-orm-lens "$DOL_COMMAND" --path "$DOL_PATH" $FORMAT_ARGS $ONLY_ARGS $DOL_ARGS