action.yml

# Version: v2.2.0
name: 'Deploy Gate'
description: 'Block AI agents from production deploys without a human-signed Ed25519 receipt. Fails closed by default.'
author: 'Permission Protocol'

branding:
  icon: 'shield'
  color: 'red'

inputs:
  pp-api-key:
    description: 'Permission Protocol API key'
    required: true
  pp-base-url:
    description: 'Permission Protocol base URL'
    required: false
    default: 'https://app.permissionprotocol.com'
  pp-request-create-token:
    description: 'Optional token to auto-create deploy requests when no receipt exists'
    required: false
    default: ''
  environment:
    description: 'Deployment environment'
    required: false
    default: 'production'
  capability:
    description: 'Capability required for this gate'
    required: false
    default: 'deploy:production'
  redeem:
    description: 'Redeem receipt on verify (use false for PR gates, true for deploy workflows)'
    required: false
    default: 'false'
  protected-paths:
    description: 'Regex pattern for protected paths used for risk assessment metadata (not gating)'
    required: false
    default: '^(deploy/|\.github/workflows/)'
  fail-on-missing:
    description: 'Fail if no receipt exists'
    required: false
    default: 'true'
  fail-open-timeout:
    description: 'Seconds to wait for PP API before treating it as unavailable'
    required: false
    default: '30'
  fail-mode:
    description: 'Failure policy when PP API is unavailable in non-production environments: closed (default) or open'
    required: false
    default: 'closed'
  production-environments:
    description: 'Comma-separated environment names treated as production and always forced fail-closed'
    required: false
    default: 'production,prod,live'
  post-comment:
    description: 'Post or update a Permission Protocol comment on PRs'
    required: false
    default: 'true'

outputs:
  approved:
    description: 'Whether the deploy was approved'
    value: ${{ steps.verify.outputs.approved }}
  receipt-id:
    description: 'Receipt ID if returned by API'
    value: ${{ steps.verify.outputs.receipt-id }}
  decision:
    description: 'Decision from receipt (APPROVED/DENIED/PENDING)'
    value: ${{ steps.verify.outputs.decision }}
  error-code:
    description: 'Error code from verification response'
    value: ${{ steps.verify.outputs.error-code }}
  error-message:
    description: 'Error message from verification response'
    value: ${{ steps.verify.outputs.error-message }}
  request-id:
    description: 'Deploy request ID (if created)'
    value: ${{ steps.verify.outputs.request-id }}
  approval-url:
    description: 'URL to approve the deploy'
    value: ${{ steps.verify.outputs.approval-url }}

runs:
  using: 'composite'
  steps:
    - name: Verify PP Receipt
      id: verify
      shell: bash
      env:
        PP_BASE_URL: ${{ inputs.pp-base-url }}
        PP_API_KEY: ${{ inputs.pp-api-key }}
        PP_REQUEST_CREATE_TOKEN: ${{ inputs.pp-request-create-token }}
        PP_ENVIRONMENT: ${{ inputs.environment }}
        PP_CAPABILITY: ${{ inputs.capability }}
        PP_REDEEM: ${{ inputs.redeem }}
        PP_FAIL_ON_MISSING: ${{ inputs.fail-on-missing }}
        PP_PROTECTED_PATHS: ${{ inputs.protected-paths }}
        PP_FAIL_OPEN_TIMEOUT: ${{ inputs.fail-open-timeout }}
        PP_FAIL_MODE: ${{ inputs.fail-mode }}
        PP_PRODUCTION_ENVIRONMENTS: ${{ inputs.production-environments }}
        PP_POST_COMMENT: ${{ inputs.post-comment }}
        PP_REPOSITORY: ${{ github.repository }}
        PP_PR_NUMBER: ${{ github.event.pull_request.number }}
        PP_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        PP_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        PP_RUN_ID: ${{ github.run_id }}
        GH_TOKEN: ${{ github.token }}
      run: |
        set -euo pipefail

        set_output() {
          local key="$1"
          local value="${2:-}"
          {
            echo "${key}<<__PP_EOF__"
            echo "${value}"
            echo "__PP_EOF__"
          } >> "$GITHUB_OUTPUT"
        }

        upsert_pr_comment() {
          local state="$1"
          local url="$2"

          if [ "${PP_POST_COMMENT}" != "true" ] || [ -z "${PP_PR_NUMBER}" ]; then
            return 0
          fi

          local marker="<!-- permission-protocol-comment -->"
          local body
          if [ "$state" = "approved" ]; then
            body=$(printf "✅ **Permission Protocol:** Approved\n[View receipt →](%s)\n\n%s" "$url" "$marker")
          else
            body=$(printf "⏳ **Permission Protocol:** Approval required\n[Review & approve →](%s)\n\n%s" "$url" "$marker")
          fi

          local comments_url="https://api.github.com/repos/${{ github.repository }}/issues/${PP_PR_NUMBER}/comments?per_page=100"
          local comments_response
          comments_response=$(curl -sS \
            -H "Authorization: token ${{ github.token }}" \
            -H "Accept: application/vnd.github+json" \
            "$comments_url" || true)

          local comment_id
          comment_id=$(echo "$comments_response" | jq -r '.[] | select((.body | contains("permission-protocol-comment")) or (.body | contains("**Permission Protocol:**"))) | .id' 2>/dev/null | head -n1 || true)

          if [ -n "$comment_id" ]; then
            curl -sS -X PATCH "https://api.github.com/repos/${{ github.repository }}/issues/comments/${comment_id}" \
              -H "Authorization: token ${{ github.token }}" \
              -H "Accept: application/vnd.github+json" \
              -H "Content-Type: application/json" \
              -d "$(jq -n --arg body "$body" '{body: $body}')" > /dev/null 2>&1 || \
              echo "⚠️ Failed to update PR comment (non-fatal)"
          else
            curl -sS -X POST "https://api.github.com/repos/${{ github.repository }}/issues/${PP_PR_NUMBER}/comments" \
              -H "Authorization: token ${{ github.token }}" \
              -H "Accept: application/vnd.github+json" \
              -H "Content-Type: application/json" \
              -d "$(jq -n --arg body "$body" '{body: $body}')" > /dev/null 2>&1 || \
              echo "⚠️ Failed to post PR comment (non-fatal)"
          fi
        }

        handle_unavailable() {
          local reason="$1"
          local fail_mode_effective="$PP_FAIL_MODE_NORMALIZED"
          if [ "$IS_PRODUCTION_ENVIRONMENT" = "true" ] && [ "$PP_FAIL_MODE_NORMALIZED" = "open" ]; then
            echo "::warning title=Permission Protocol::fail-mode=open requested but environment '${PP_ENVIRONMENT}' is production; forcing fail-mode=closed."
            fail_mode_effective="closed"
          fi

          if [ "$IS_PRODUCTION_ENVIRONMENT" = "true" ]; then
            echo "::error title=Permission Protocol::Verification API unavailable. Failing CLOSED for production environment '${PP_ENVIRONMENT}'. Reason: ${reason}"
            set_output "approved" "false"
            set_output "receipt-id" ""
            set_output "decision" ""
            set_output "error-code" "PP_UNAVAILABLE"
            set_output "error-message" "$reason"
            set_output "request-id" ""
            set_output "approval-url" ""
            exit 1
          fi

          if [ "$fail_mode_effective" = "open" ]; then
            echo "::warning title=Permission Protocol::Verification API unavailable in non-production env '${PP_ENVIRONMENT}'. Fail-mode=open (opt-in). Reason: ${reason}"
            set_output "approved" "true"
            set_output "receipt-id" ""
            set_output "decision" ""
            set_output "error-code" "PP_UNAVAILABLE"
            set_output "error-message" "$reason"
            set_output "request-id" ""
            set_output "approval-url" ""
            exit 0
          fi

          echo "::error title=Permission Protocol::Verification API unavailable. Failing CLOSED for non-production environment '${PP_ENVIRONMENT}'. Reason: ${reason}"
          set_output "approved" "false"
          set_output "receipt-id" ""
          set_output "decision" ""
          set_output "error-code" "PP_UNAVAILABLE"
          set_output "error-message" "$reason"
          set_output "request-id" ""
          set_output "approval-url" ""
          exit 1
        }

        REPO="${PP_REPOSITORY,,}"

        if ! command -v jq >/dev/null 2>&1; then
          echo "❌ jq is required for this action"
          exit 1
        fi

        REDEEM_JSON=false
        if [ "${PP_REDEEM}" = "true" ]; then
          REDEEM_JSON=true
        fi

        FAIL_ON_MISSING_JSON=true
        if [ "${PP_FAIL_ON_MISSING}" = "false" ]; then
          FAIL_ON_MISSING_JSON=false
        fi

        PP_FAIL_MODE_NORMALIZED=$(echo "${PP_FAIL_MODE:-closed}" | tr '[:upper:]' '[:lower:]')
        if [ "$PP_FAIL_MODE_NORMALIZED" != "open" ] && [ "$PP_FAIL_MODE_NORMALIZED" != "closed" ]; then
          PP_FAIL_MODE_NORMALIZED="closed"
        fi

        normalize_csv_items() {
          echo "$1" | tr ',' '\n' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]'
        }

        IS_PRODUCTION_ENVIRONMENT=false
        PP_ENVIRONMENT_NORMALIZED=$(echo "${PP_ENVIRONMENT}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]')
        while IFS= read -r env_name; do
          if [ -n "$env_name" ] && [ "$PP_ENVIRONMENT_NORMALIZED" = "$env_name" ]; then
            IS_PRODUCTION_ENVIRONMENT=true
            break
          fi
        done < <(normalize_csv_items "${PP_PRODUCTION_ENVIRONMENTS}")

        # Skip the gate entirely for draft PRs — not ready for review/approval.
        # When the PR is marked ready for review, the gate will run again.
        if [ -n "${PP_PR_NUMBER}" ]; then
          IS_DRAFT=$(gh pr view "${PP_PR_NUMBER}" --json isDraft --jq '.isDraft' 2>/dev/null || echo "false")
          if [ "$IS_DRAFT" = "true" ]; then
            echo "⏭️  Skipping Permission Protocol gate — PR #${PP_PR_NUMBER} is a draft"
            set_output "approved" "true"
            set_output "receipt-id" ""
            set_output "decision" "DRAFT_SKIPPED"
            set_output "error-code" ""
            set_output "error-message" ""
            set_output "request-id" ""
            set_output "approval-url" ""
            exit 0
          fi
        fi

        echo "🔍 Collecting changed files for risk metadata..."
        CHANGED_FILES=$(gh pr view "${PP_PR_NUMBER}" --json files --jq '.files[].path' 2>/dev/null || echo "")
        if [ -z "$CHANGED_FILES" ]; then
          echo "⚠️ Could not get changed files via GitHub API, falling back to git diff"
          CHANGED_FILES=$(git diff --name-only "${PP_PR_BASE_SHA}...${PP_PR_HEAD_SHA}" 2>/dev/null || echo "")
        fi

        if [ -n "$CHANGED_FILES" ]; then
          echo "Changed files:"
          echo "$CHANGED_FILES"
          CHANGED_FILES_JSON=$(echo "$CHANGED_FILES" | jq -R -s 'split("\n") | map(select(length > 0))')
        else
          CHANGED_FILES_JSON='[]'
        fi

        PROTECTED_PATHS_CHANGED=false
        if [ -n "$CHANGED_FILES" ] && echo "$CHANGED_FILES" | grep -E "$PP_PROTECTED_PATHS" >/dev/null 2>&1; then
          PROTECTED_PATHS_CHANGED=true
          echo "Protected paths changed: true"
        else
          echo "Protected paths changed: false"
        fi

        REQUEST_BODY=$(jq -n \
          --arg repo "$REPO" \
          --argjson prNumber "${PP_PR_NUMBER}" \
          --arg headSha "$PP_PR_HEAD_SHA" \
          --arg env "$PP_ENVIRONMENT" \
          --arg capability "$PP_CAPABILITY" \
          --argjson redeem "$REDEEM_JSON" \
          --argjson failOnMissing "$FAIL_ON_MISSING_JSON" \
          --argjson protectedPathsChanged "$PROTECTED_PATHS_CHANGED" \
          --argjson changedFiles "$CHANGED_FILES_JSON" \
          '{
            scope: {
              repo: $repo,
              prNumber: $prNumber,
              headSha: $headSha,
              env: $env,
              capability: $capability
            },
            redeem: $redeem,
            failOnMissing: $failOnMissing,
            protectedPathsChanged: $protectedPathsChanged,
            changedFiles: $changedFiles
          }')

        echo ""
        echo "═══════════════════════════════════════════════════════════"
        echo "  🔐 PERMISSION PROTOCOL - Deploy Authorization Required"
        echo "═══════════════════════════════════════════════════════════"

        CURL_HEADERS=(
          -H "Content-Type: application/json"
          -H "X-PP-API-Key: ${PP_API_KEY}"
          -H "X-PP-Request-Source: github-actions"
          -H "X-GitHub-Run-Id: ${PP_RUN_ID}"
        )

        if [ -n "${PP_REQUEST_CREATE_TOKEN}" ]; then
          CURL_HEADERS+=( -H "X-PP-Request-Create-Token: ${PP_REQUEST_CREATE_TOKEN}" )
        fi

        set +e
        HTTP_RESPONSE=$(curl -sS -w "\n%{http_code}" \
          --max-time "${PP_FAIL_OPEN_TIMEOUT}" \
          -X POST "${PP_BASE_URL}/api/v1/receipts/verify" \
          "${CURL_HEADERS[@]}" \
          -d "${REQUEST_BODY}")
        CURL_EXIT=$?
        set -e

        if [ "$CURL_EXIT" -ne 0 ]; then
          handle_unavailable "API request failed (curl exit ${CURL_EXIT})"
        fi

        HTTP_BODY=$(echo "$HTTP_RESPONSE" | sed '$d')
        HTTP_STATUS=$(echo "$HTTP_RESPONSE" | tail -n1)

        if [ -z "$HTTP_BODY" ] || [ "$HTTP_STATUS" = "000" ]; then
          handle_unavailable "Empty response from Permission Protocol"
        fi

        VALID=$(echo "$HTTP_BODY" | jq -r '.valid // .result.valid // false' 2>/dev/null || echo "false")
        CARRIED_FORWARD=$(echo "$HTTP_BODY" | jq -r '.carriedForward // .result.carriedForward // false' 2>/dev/null || echo "false")
        RECEIPT_ID=$(echo "$HTTP_BODY" | jq -r '.receiptId // .receipt.id // .result.receiptId // .result.receipt.id // empty' 2>/dev/null || echo "")
        DECISION=$(echo "$HTTP_BODY" | jq -r '.decision // .result.decision // empty' 2>/dev/null || echo "")
        ERROR_CODE=$(echo "$HTTP_BODY" | jq -r '.errorCode // .result.errorCode // .error.code // empty' 2>/dev/null || echo "")
        ERROR_MESSAGE=$(echo "$HTTP_BODY" | jq -r '.errorMessage // .result.errorMessage // .error.message // empty' 2>/dev/null || echo "")
        REQUEST_ID=$(echo "$HTTP_BODY" | jq -r '.requestId // .result.requestId // empty' 2>/dev/null || echo "")
        APPROVAL_URL=$(echo "$HTTP_BODY" | jq -r '.approvalUrl // .result.approvalUrl // empty' 2>/dev/null || echo "")
        SKIP_REASON=$(echo "$HTTP_BODY" | jq -r '.creationSkippedReason // .result.creationSkippedReason // empty' 2>/dev/null || echo "")

        COMPANY_ID=$(echo "$HTTP_BODY" | jq -r '.company.id // .result.company.id // empty' 2>/dev/null || echo "")
        COMPANY_SLUG=$(echo "$HTTP_BODY" | jq -r '.company.slug // .result.company.slug // empty' 2>/dev/null || echo "")
        COMPANY_NAME=$(echo "$HTTP_BODY" | jq -r '.company.name // .result.company.name // empty' 2>/dev/null || echo "")

        DIAG_REQUESTED_COMPANY_ID=$(echo "$HTTP_BODY" | jq -r '.diagnostics.requestedCompanyId // .result.diagnostics.requestedCompanyId // empty' 2>/dev/null || echo "")
        DIAG_RESOLVED_COMPANY_ID=$(echo "$HTTP_BODY" | jq -r '.diagnostics.resolvedCompanyId // .result.diagnostics.resolvedCompanyId // empty' 2>/dev/null || echo "")
        DIAG_SIGNER_KEY_ID=$(echo "$HTTP_BODY" | jq -r '.diagnostics.signerKeyId // .result.diagnostics.signerKeyId // empty' 2>/dev/null || echo "")
        DIAG_VERIFIER_KEY_ID=$(echo "$HTTP_BODY" | jq -r '.diagnostics.verifierKeyId // .result.diagnostics.verifierKeyId // empty' 2>/dev/null || echo "")
        DIAG_KEY_SOURCE=$(echo "$HTTP_BODY" | jq -r '.diagnostics.keySource // .result.diagnostics.keySource // empty' 2>/dev/null || echo "")
        DIAG_KEY_STATUS=$(echo "$HTTP_BODY" | jq -r '.diagnostics.keyStatus // .result.diagnostics.keyStatus // empty' 2>/dev/null || echo "")

        if [ -n "$REQUEST_ID" ]; then
          REVIEW_URL="${PP_BASE_URL}/pp/deploy-requests/${REQUEST_ID}"
        else
          REVIEW_URL="$APPROVAL_URL"
        fi

        set_output "approved" "$VALID"
        set_output "receipt-id" "$RECEIPT_ID"
        set_output "decision" "$DECISION"
        set_output "error-code" "$ERROR_CODE"
        set_output "error-message" "$ERROR_MESSAGE"
        set_output "request-id" "$REQUEST_ID"
        set_output "approval-url" "$REVIEW_URL"

        if [ "$VALID" = "true" ]; then
          echo ""
          if [ "$CARRIED_FORWARD" = "true" ]; then
            echo "  ✅ APPROVED — Carried forward from PR-level approval"
          else
            echo "  ✅ APPROVED — Receipt verified"
          fi
          if [ -n "$RECEIPT_ID" ]; then
            echo "  📋 Receipt: ${RECEIPT_ID}"
          fi
          if [ -n "$REVIEW_URL" ]; then
            echo "  🔗 ${REVIEW_URL}"
          fi
          echo ""
          echo "═══════════════════════════════════════════════════════════"

          if [ -n "$REVIEW_URL" ]; then
            upsert_pr_comment "approved" "$REVIEW_URL"
          fi
          exit 0
        fi

        case "$ERROR_CODE" in
          "RECEIPT_NOT_FOUND"|"PP_NO_RECEIPT")
            echo ""
            echo "  ❌ NO RECEIPT — Human approval required"
            echo ""
            if [ -n "$REVIEW_URL" ]; then
              echo "  👉 APPROVE HERE:"
              echo "     ${REVIEW_URL}"
              echo ""
            else
              echo "  👉 ${PP_BASE_URL}/pp/deploy-requests"
              echo ""
            fi
            echo "═══════════════════════════════════════════════════════════"
            echo ""
            # Details (collapsed in logs, visible if expanded)
            echo "Details: repo=${REPO} pr=#${PP_PR_NUMBER} sha=${PP_PR_HEAD_SHA:0:10}"
            if [ -n "$REQUEST_ID" ]; then
              echo "Request: ${REQUEST_ID}"
            fi
            if [ -n "$COMPANY_SLUG" ]; then
              echo "Company: ${COMPANY_NAME:-$COMPANY_SLUG}"
            fi
            if [ -n "$SKIP_REASON" ]; then
              echo "Note: Request creation skipped — ${SKIP_REASON}"
            fi
            if [ -n "$REVIEW_URL" ]; then
              upsert_pr_comment "pending" "$REVIEW_URL"
            fi
            if [ "${PP_FAIL_ON_MISSING}" = "false" ]; then
              echo "⚡ Continuing (fail-on-missing=false)"
              exit 0
            fi
            exit 1
            ;;
          "RECEIPT_ALREADY_REDEEMED")
            echo "❌ FAIL: Receipt already redeemed"
            echo "This permission has already been consumed."
            exit 1
            ;;
          "RECEIPT_EXPIRED")
            echo "❌ FAIL: Receipt expired"
            echo "Request a new approval and re-run."
            exit 1
            ;;
          "RECEIPT_DENIED")
            echo "❌ FAIL: Receipt denied"
            if [ -n "$ERROR_MESSAGE" ]; then
              echo "$ERROR_MESSAGE"
            fi
            exit 1
            ;;
          "SIGNATURE_INVALID"|"KEY_REVOKED")
            echo "❌ FAIL: Signature verification failed (${ERROR_CODE})"
            if [ -n "$ERROR_MESSAGE" ]; then
              echo "$ERROR_MESSAGE"
            fi
            if [ -n "$DIAG_REQUESTED_COMPANY_ID" ] || [ -n "$DIAG_RESOLVED_COMPANY_ID" ]; then
              echo "Diagnostics company IDs: requested=${DIAG_REQUESTED_COMPANY_ID:-none} resolved=${DIAG_RESOLVED_COMPANY_ID:-none}"
            fi
            if [ -n "$DIAG_SIGNER_KEY_ID" ] || [ -n "$DIAG_VERIFIER_KEY_ID" ]; then
              echo "Diagnostics key IDs: signer=${DIAG_SIGNER_KEY_ID:-none} verifier=${DIAG_VERIFIER_KEY_ID:-none}"
            fi
            if [ -n "$DIAG_KEY_SOURCE" ] || [ -n "$DIAG_KEY_STATUS" ]; then
              echo "Diagnostics key source/status: ${DIAG_KEY_SOURCE:-none}/${DIAG_KEY_STATUS:-none}"
            fi
            exit 1
            ;;
          "")
            echo "❌ FAIL: Verification failed"
            if [ -n "$ERROR_MESSAGE" ]; then
              echo "$ERROR_MESSAGE"
            fi
            echo "Raw response:"
            echo "$HTTP_BODY" | jq '.' || echo "$HTTP_BODY"
            exit 1
            ;;
          *)
            echo "❌ FAIL: ${ERROR_CODE}"
            if [ -n "$ERROR_MESSAGE" ]; then
              echo "$ERROR_MESSAGE"
            fi
            exit 1
            ;;
        esac