# Dogfood: run Gatekeep on PRs to THIS repo (layue13/gatekeep).
# Gitea Actions discovers workflows under .github/workflows/ (not /workflows/).
#
# Secret: OPENROUTER_API_KEY (already configured on this repo)
# Action: in-repo composite at repository root (uses: ./)
#
# Important (uses: ./):
# - Checkout is the PR head, so Action fixes on main do NOT apply until the
#   PR branch rebases/merges main. Stale heads can look "broken" after a fix.
# - Re-run: push an empty commit, or Actions → this workflow → Run workflow
#   (workflow_dispatch; uses default branch / manual inputs as configured).

name: Gatekeep

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:

jobs:
  gatekeep:
    name: gatekeep
    runs-on: ubuntu-latest
    # Skip drafts on pull_request; allow manual dispatch
    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false
    steps:
      - name: Checkout PR / default branch
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
        with:
          persist-credentials: false

      - name: Gatekeep review (in-repo Action)
        id: gk
        # Local composite action — action.yml at repo root
        uses: ./
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-verify: "true"
          retain-artifacts: "true"

      - name: Job summary
        if: always()
        run: |
          {
            echo "## Gatekeep dogfood"
            echo "risk_tier=${{ steps.gk.outputs.risk_tier }}"
            echo "security_blocking=${{ steps.gk.outputs.security_blocking }}"
            echo "agreed_count=${{ steps.gk.outputs.agreed_count }}"
          } >> "$GITHUB_STEP_SUMMARY"