know-code.yml

name: know-code

# PR: checkout the tip (not pull/N/merge) and run default verify.
# Push: walk github.event.before..HEAD so landings on main still match
# per-run trailers (origin/main == HEAD has no merge-base range).
on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: [main]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
          # Default pull_request checkout is a merge commit (no trailers).
          # Verify must run on the PR tip that carries Know-Code-Verified.
          # On push, head.sha is empty so this is github.sha (the new tip).
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: actions/setup-node@v5
        with:
          node-version: "22"
          cache: npm

      - name: Install and build CLI
        run: |
          npm install
          npm run build
          npm install -g ./packages/cli

      - name: Ensure requireTrailer for CI
        run: |
          mkdir -p .know-code
          printf '{\n  "level": "standard",\n  "baseBranch": "main",\n  "requireTrailer": true\n}\n' > .know-code/config.json

      - name: Verify Know-Code-Verified trailer
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            BEFORE="${{ github.event.before }}"
            if [[ "$BEFORE" =~ ^0+$ ]]; then
              echo "know-code: new branch push — skip walk"
              exit 0
            fi
            know-code verify --from "$BEFORE"
          else
            know-code verify
          fi