A3-aux-audit.yml

# .github/workflows/aux-audit.yml
# Drop this into your repo. Point at your spec. Ship.
#
# STATUS — aux-audit v0.1 CLI in active development. This workflow describes the
# v0.1 contract; it will fail with "package not found" until the CLI ships to npm.
# Adopt the spec format and stage this workflow now; it becomes live the day v0.1 ships.
# Follow: https://github.com/auxfirst/aux-audit
#
# What it does (once v0.1 ships):
#   - Runs aux-audit on every PR that touches the spec, flows, or golden transcripts.
#   - Emits SARIF, uploaded as code-scanning findings.
#   - Fails the build on any severity: high violation.
# Local repro (once v0.1 ships): npx aux-audit run ./spec.yaml --fail-on high
#
# Source: https://github.com/auxfirst/aux-audit

name: aux-audit

on:
  pull_request:
    paths:
      - "spec.yaml"
      - "flows/**"
      - "transcripts/**"
      - "audit.config.yaml"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write   # required to upload SARIF
  pull-requests: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Run aux-audit
        run: |
          npx aux-audit run ./spec.yaml \
            --config ./audit.config.yaml \
            --format sarif \
            --out audit.sarif \
            --fail-on high

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: audit.sarif
          category: aux-audit

      - name: Comment scorecard
        if: always()
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: aux-audit
          path: audit-summary.md