auth0__agent-skills/.github/workflows/skillsaw.yml

name: skillsaw
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

concurrency:
  group: skillsaw-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      UV_PYTHON: "3.12"
      SKILLSAW_VERSION: "0.16.0"
    steps:
    - name: Checkout
      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

    - name: Install uv
      uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
      with:
        python-version: ${{ env.UV_PYTHON }}

    - name: Cache uv tool env
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: ~/.cache/uv
        key: uv-${{ runner.os }}-py${{ env.UV_PYTHON }}-skillsaw-${{ env.SKILLSAW_VERSION }}

    - name: Run skillsaw in strict mode
      id: skillsaw
      continue-on-error: true
      env:
        NO_COLOR: "1"
      run: |
        set +e  # Don't exit on error; we capture the exit code manually below
        # -q suppresses uv's download/install noise on stderr
        uvx -q "skillsaw==${SKILLSAW_VERSION}" --strict \
          | tee skillsaw.txt
        EXIT_CODE=${PIPESTATUS[0]}
        echo "exit_code=${EXIT_CODE}" >> $GITHUB_OUTPUT

        # Capture output for PR comment
        {
          echo "report<<EOF"
          cat skillsaw.txt
          echo "EOF"
        } >> $GITHUB_OUTPUT

        exit 0  # Always succeed so the PR comment step runs before we fail the job

    - name: Prepare skillsaw results
      if: always()
      id: prepare-comment
      run: |
        EXIT_CODE="${{ steps.skillsaw.outputs.exit_code }}"
        if [ "$EXIT_CODE" = "0" ]; then
          echo "header=✅ skillsaw — All checks passed" >> $GITHUB_OUTPUT
          echo "details_open=" >> $GITHUB_OUTPUT  # Empty = <details> closed by default
        else
          echo "header=❌ skillsaw — Issues found" >> $GITHUB_OUTPUT
          echo "details_open= open" >> $GITHUB_OUTPUT  # Leading space + "open" renders as <details open>
        fi

    - name: Post skillsaw results as PR comment
      if: ${{ always() && github.event_name == 'pull_request' }}
      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
      with:
        comment-tag: skillsaw
        mode: recreate
        message: |
          ## ${{ steps.prepare-comment.outputs.header }}

          <details${{ steps.prepare-comment.outputs.details_open }}>
          <summary>Full report</summary>

          ```
          ${{ steps.skillsaw.outputs.report }}
          ```

          </details>

          > [`skillsaw ${{ env.SKILLSAW_VERSION }}`](https://github.com/stbenjam/skillsaw) · [config](${{ github.server_url }}/${{ github.repository }}/blob/${{ github.event.pull_request.head.sha }}/.skillsaw.yaml) · [custom rules](${{ github.server_url }}/${{ github.repository }}/blob/${{ github.event.pull_request.head.sha }}/.skillsaw/rules.py) · [run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})

    - name: Fail if skillsaw failed
      if: steps.skillsaw.outputs.exit_code != '0'
      run: exit 1

    - name: Router reachability check
      run: |
        # This job only sets up uv/uvx (for skillsaw), so pytest is not on the
        # runner's python. Run both via `uv run` with pytest provided ephemerally.
        uv run --with pytest python -m pytest scripts/test_check_router_reachability.py -q
        uv run python scripts/check_router_reachability.py plugins/auth0/skills/auth0

    - name: Router routing evals
      run: |
        # Assert curated developer requests (features + SDK+feature combos)
        # resolve to an existing Step 4 section and reference files.
        uv run --with pytest python -m pytest scripts/test_check_routing_evals.py -q
        uv run python scripts/check_routing_evals.py plugins/auth0/skills/auth0

    - name: Structural gate (validate-skill.sh)
      run: |
        # Local structural gate: enforces EXPECTED_FRAMEWORKS presence,
        # description length, and old-file-removal guards in CI (not just
        # locally). Invoked via `bash` so no chmod dependency is needed.
        bash plugins/auth0/skills/auth0/scripts/validate-skill.sh

    - name: Upload linter output
      if: always()
      uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.4.0
      with:
        name: skillsaw-report
        path: skillsaw.txt
        if-no-files-found: error