Architecture governance for the AI-agent era
Code-gen-time + PR-time. Same engine.

# ArchRails Architecture Governance — GitHub CI Mode
# Required secrets:  ARCHRAILS_TENANT_ID · ARCHRAILS_TOKEN · ARCHRAILS_WEBHOOK_URL
# GITHUB_TOKEN is auto-provisioned by Actions — no configuration needed.

name: ArchRails Architecture Check
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

jobs:
  archrails-check:
    name: Architecture Governance
    runs-on: ubuntu-latest
    permissions:
      contents: read         # read repo contents for diff fetch
      pull-requests: write   # post review comments
      statuses: write        # write commit status

    steps:
      - name: Send PR event to ArchRails
        env:
          ARCHRAILS_TENANT_ID: ${{ secrets.ARCHRAILS_TENANT_ID }}
          ARCHRAILS_TOKEN:     ${{ secrets.ARCHRAILS_TOKEN }}
          ARCHRAILS_URL:       ${{ secrets.ARCHRAILS_WEBHOOK_URL }}
          GITHUB_TOKEN:        ${{ secrets.GITHUB_TOKEN }}
          PR_EVENT:            ${{ toJson(github.event) }}
          RUN_ID:              ${{ github.run_id }}
          RUN_ATTEMPT:         ${{ github.run_attempt }}
        run: |
          # Inject archrails_tenant_id and github_token into the PR event payload.
          # The workflow's own GITHUB_TOKEN lets downstream Lambdas fetch the diff
          # and post review results — no separate installation token required.
          PAYLOAD=$(echo "$PR_EVENT" | jq \
            --arg tenant_id    "$ARCHRAILS_TENANT_ID" \
            --arg github_token "$GITHUB_TOKEN" \
            '. + {archrails_tenant_id: $tenant_id, github_token: $github_token}')

          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            --max-time 30 \
            -X POST "$ARCHRAILS_URL" \
            -H "Content-Type: application/json" \
            -H "X-GitHub-Event: pull_request" \
            -H "X-GitHub-Delivery: ${RUN_ID}-${RUN_ATTEMPT}" \
            -H "X-ArchRails-CI: github" \
            -H "X-ArchRails-Token: $ARCHRAILS_TOKEN" \
            -d "$PAYLOAD")

          echo "ArchRails response: $HTTP_STATUS"

          # 202 = queued  |  204 = ignored (draft, disabled, etc.)
          # 4xx/5xx = configuration problem — surface it.
          if [[ "$HTTP_STATUS" -ge 400 ]]; then
            echo "::error::ArchRails rejected the payload (HTTP $HTTP_STATUS). Check ARCHRAILS_TOKEN and ARCHRAILS_TENANT_ID."
            exit 1
          fi
          echo "ArchRails review queued successfully."