typescript-client-endpoint-audit.yml

---
name: TypeScript client endpoint audit

on:
    push:
        branches: [main]
    pull_request:

# The audit only reads the checked-out tree and writes to the job summary.
permissions:
    contents: read

defaults:
    run:
        working-directory: clients/typescript

jobs:
  # Report divergences between handwritten Agent Server calls and the pinned
  # server's OpenAPI contract. See scripts/endpoint-audit.mjs.
    endpoint-audit:
        runs-on: ubuntu-latest
        timeout-minutes: 15
        steps:
            - name: Checkout code
              uses: actions/checkout@v7

            - name: Use Node.js 22.x
              uses: actions/setup-node@v6
              with:
                  node-version: 22.x
                  cache: npm
                  cache-dependency-path: clients/typescript/package-lock.json

            - name: Install dependencies
              run: npm ci

            - name: Test endpoint-audit tooling
              run: npm run test:endpoint-audit-tooling

            - name: Endpoint audit (report-only — client vs pinned release contract)
              run: npm run audit:endpoints

            - name: Upload audit report
              if: always()
              uses: actions/upload-artifact@v4
              with:
                  name: endpoint-audit
                  path: clients/typescript/.audit/
          # .audit/ is a dot-directory; upload-artifact@v4 skips hidden paths by default.
                  include-hidden-files: true

      # The report's only destination. A job summary needs no token, so it
      # renders identically for fork and same-repo PRs.
            - name: Write audit report to the job summary
              if: always()
              uses: actions/github-script@v7
              with:
                  script: |
                      const fs = require('node:fs');
                      const reportPath =
                        'clients/typescript/.audit/endpoint-audit.json';
                      if (!fs.existsSync(reportPath)) {
                        core.warning(`No audit report at ${reportPath}.`);
                        return;
                      }
                      const { renderEndpointAuditReport } = require(
                        './.github/scripts/render-typescript-endpoint-audit-report.cjs'
                      );
                      const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
                      await core.summary
                        .addRaw(renderEndpointAuditReport(report))
                        .write();