materialize-check.yml

name: Grapity materialize check

# SETUP
# -----
# Reports spec drift on every pull request: compares grapity-lock.json
# against the live registry and upserts a sticky PR comment showing either
# the outdated specs (materialized vs latest version) or an all-clear note.
# Stale specs also appear as inline warnings in the checks UI.
#
# Works out of the box against public specs (anonymous reads): the only
# configuration needed is a GRAPITY_REGISTRY_URL variable under Settings >
# Secrets and variables > Actions (e.g. https://registry.grapity.dev). The
# pull-requests: write permission (already declared) lets the workflow post
# and update the comment.
#
# Authenticated registry (Keycloak client credentials): replace the
# auth-mode: none line with the commented keycloak inputs below, and add the
# KEYCLOAK_SERVER_URL, KEYCLOAK_REALM, and KEYCLOAK_CLIENT_ID variables plus
# the KEYCLOAK_CLIENT_SECRET secret (the client needs the specs:read scope).
#
# Stale specs never fail the pipeline by default. BLOCKING MODE: add
# fail-on-stale: "true" to the inputs. The comment still posts even when the
# job goes red.
#
# Pin the action to a release tag for reproducibility, e.g.
# grapitydev/grapity/actions/grapity@v0.17.0

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write

jobs:
  materialize-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check materialized specs
        uses: grapitydev/grapity/actions/grapity@main # pin to a release tag
        with:
          command: check
          registry-url: ${{ vars.GRAPITY_REGISTRY_URL }}
          auth-mode: none
          # Authenticated registry (Keycloak client credentials):
          # auth-mode: keycloak
          # keycloak-server-url: ${{ vars.KEYCLOAK_SERVER_URL }}
          # realm: ${{ vars.KEYCLOAK_REALM }}
          # client-id: ${{ vars.KEYCLOAK_CLIENT_ID }}
          # client-secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
          # Blocking mode:
          # fail-on-stale: "true"