# fastpace pre-merge audit gate (F2.9)
#
# Drop this into .github/workflows/fastpace-audit-gate.yml.
# It runs `fastpace gate check --format github` on every PR; the gate
# fails the workflow if any required check fails.
#
# Required repo secrets/permissions: none for a self-checking gate.
# The gate reads fastpace/audit.log, AI-BOMs, and identity from the repo.

name: fastpace audit gate

on:
  pull_request:
    branches: [main, master, release/**]
  push:
    branches: [main, master, release/**]

jobs:
  audit-gate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # need full history for provenance trailers

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install fastpace
        run: npm install -g @fastpace-ai/fp

      - name: Run audit gate
        run: fastpace gate check --format github