# Example: Workspai agent grounding gate for consumer workspaces
#
# Copy to your repo as `.github/workflows/workspai-agent-grounding.yml`
# and adjust `working-directory` to your Workspai workspace root.
#
# Requires: Node.js 20+, `workspai` available via npx in CI.

name: Workspai Agent Grounding

on:
  pull_request:
    paths:
      - '.workspai/**'
      - '.rapidkit/**'
      - 'AGENTS.md'
      - 'CLAUDE.md'
      - '.github/copilot-instructions.md'
      - '.cursor/rules/**'
  workflow_dispatch:

jobs:
  agent-grounding:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: . # set to your workspace root if nested

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Workspai CLI
        run: npm install --no-save workspai

      - name: Run canonical Workspace Intelligence chain
        # Exit 1 = hard execution failure; exit 2 = completed but evidence-blocked.
        # Continue here only so the durable run report and blocker evidence can
        # always be uploaded; the final step below still fails either outcome.
        run: npx workspai workspace intelligence run --for-agent generic --strict --json
        continue-on-error: true
        id: intelligence

      - name: Run separate governance pipeline
        run: npx workspai pipeline --json --strict --no-agent-sync
        continue-on-error: true
        id: pipeline

      - name: Verify agent grounding drift
        run: node ./node_modules/workspai/scripts/check-agent-customization-drift.mjs --workspace .

      - name: Upload agent grounding artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: workspai-agent-grounding
          path: |
            .workspai/reports/INDEX.json
            .workspai/reports/workspace-context-agent.json
            .workspai/reports/workspace-intelligence-run-last-run.json
            .workspai/reports/agent-customization-pack.json
            .workspai/reports/workspai-mcp-design.json
            .workspai/reports/pipeline-last-run.json
            AGENTS.md
          if-no-files-found: ignore

      - name: Fail if canonical chain or pipeline blocked
        if: steps.intelligence.outcome == 'failure' || steps.pipeline.outcome == 'failure'
        run: exit 1