# Gavel audit → SARIF → GitHub Code Scanning (consumer recipe)
#
# Copy the YAML block below into your automation repo as:
#   .github/workflows/gavel-audit.yml
#
# No LLM, no IDE skills, no Bailiff — only the pinned npm CLI.
# `gavel audit` includes self-check by default (see docs/CLI_MATRIX.md).
# Baseline ratchet (`gavel baseline write` / `check`) landed in v0.12; gate on failThreshold or baseline check.

name: gavel-audit

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Run Gavel audit (SARIF)
        id: gavel
        continue-on-error: true
        run: npx --yes @dsolisp/gavel@0.12.1 audit --format sarif > gavel.sarif

      - name: Upload SARIF to Code Scanning
        if: always() && hashFiles('gavel.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: gavel.sarif
          category: gavel

      - name: Fail job on Gavel findings
        if: steps.gavel.outcome == 'failure'
        run: |
          echo "Gavel audit exited non-zero (findings at/above failThreshold or usage error)."
          exit 1