Enforce your architecture
at pull request time

# ArchRails Architecture Governance — GitHub CI Mode
# Required secrets:  ARCHRAILS_TENANT_ID · ARCHRAILS_TOKEN · ARCHRAILS_WEBHOOK_URL
# GITHUB_TOKEN is auto-provisioned by Actions — no configuration needed.

name: ArchRails Architecture Check
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

jobs:
  archrails-check:
    name: Architecture Governance
    runs-on: ubuntu-latest
    permissions:
      contents: read         # read repo contents for diff fetch
      pull-requests: write   # post review comments
      statuses: write        # write commit status

    steps:
      - name: Send PR event to ArchRails
        env:
          ARCHRAILS_TENANT_ID: ${{ secrets.ARCHRAILS_TENANT_ID }}
          ARCHRAILS_TOKEN:     ${{ secrets.ARCHRAILS_TOKEN }}
          ARCHRAILS_URL:       ${{ secrets.ARCHRAILS_WEBHOOK_URL }}
          GITHUB_TOKEN:        ${{ secrets.GITHUB_TOKEN }}
          PR_EVENT:            ${{ toJson(github.event) }}
          RUN_ID:              ${{ github.run_id }}
          RUN_ATTEMPT:         ${{ github.run_attempt }}
        run: |
          # Inject archrails_tenant_id and github_token into the PR event payload.
          # github_token lets downstream Lambdas fetch the diff and post review
          # results without a GitHub App installation token.
          PAYLOAD=$(echo "$PR_EVENT" | jq \
            --arg tenant_id    "$ARCHRAILS_TENANT_ID" \
            --arg github_token "$GITHUB_TOKEN" \
            '. + {archrails_tenant_id: $tenant_id, github_token: $github_token}')

          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            --max-time 30 \
            -X POST "$ARCHRAILS_URL" \
            -H "Content-Type: application/json" \
            -H "X-GitHub-Event: pull_request" \
            -H "X-GitHub-Delivery: ${RUN_ID}-${RUN_ATTEMPT}" \
            -H "X-ArchRails-CI: github" \
            -H "X-ArchRails-Token: $ARCHRAILS_TOKEN" \
            -d "$PAYLOAD")

          echo "ArchRails response: $HTTP_STATUS"

          # 202 = queued  |  204 = ignored (draft, disabled, etc.)
          # 4xx/5xx = configuration problem — surface it.
          if [[ "$HTTP_STATUS" -ge 400 ]]; then
            echo "::error::ArchRails rejected the payload (HTTP $HTTP_STATUS). Check ARCHRAILS_TOKEN and ARCHRAILS_TENANT_ID."
            exit 1
          fi
          echo "ArchRails review queued successfully."

stages:
  - review

archrails_review:
  stage: review
  image: alpine:3.20
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  before_script:
    - apk add --no-cache curl
  script:
    - |
      curl --silent --fail -X POST "${ARCHRAILS_ENDPOINT}" \
        -H "X-Gitlab-Token: ${GITLAB_WEBHOOK_SECRET}" \
        -H "X-Gitlab-Event: Merge Request Hook" \
        -H "Content-Type: application/json" \
        -d "{
          \"archrails_tenant_id\": \"${ARCHRAILS_TENANT_ID}\",
          \"object_kind\": \"merge_request\",
          \"project\": {
            \"id\": ${CI_PROJECT_ID},
            \"path_with_namespace\": \"${CI_PROJECT_PATH}\"
          },
          \"object_attributes\": {
            \"iid\": ${CI_MERGE_REQUEST_IID},
            \"action\": \"update\",
            \"last_commit\": { \"id\": \"${CI_COMMIT_SHA}\" }
          }
        }"