name: 'ctxlint'
description: 'Lint AI agent context files and MCP server configs against your actual codebase'
branding:
  icon: 'check-circle'
  color: 'blue'

inputs:
  args:
    description: 'CLI arguments to pass to ctxlint (default: --strict)'
    required: false
    default: '--strict'
  version:
    description: 'ctxlint version to use (default: latest)'
    required: false
    default: 'latest'

runs:
  using: 'composite'
  steps:
    - name: Set up Node.js
      uses: actions/setup-node@v6
      with:
        node-version: '20'

    - name: Run ctxlint
      shell: bash
      # Inputs flow through env vars, never interpolated inline into the
      # script body: expression interpolation pastes the raw input into the
      # shell script before it runs, so a consumer workflow that wires
      # attacker-influenceable data (issue title, branch name) into `with:`
      # would hand that data command execution on their runner.
      # CTXLINT_ARGS is expanded unquoted on purpose -- it carries multiple
      # whitespace-separated CLI flags that must word-split.
      env:
        CTXLINT_VERSION: ${{ inputs.version }}
        CTXLINT_ARGS: ${{ inputs.args }}
      run: npx -y "@yawlabs/ctxlint@${CTXLINT_VERSION}" ${CTXLINT_ARGS}