action.yml

name: Verify GitHub Actions References
description: >
  Checks if any called GitHub Actions or Workflows reference an unexpected version.

inputs:
  path-include-list:
    required: false
    default: '@(".github")'
    description: >
      PowerShell string array of paths, relative to repository root, to search for GHA files, e.g. '@(".github")' or
      '@(".github/actions", ".github/workflows")'. The parameter must be a PowerShell string array.
  file-include-list:
    required: false
    default: '@("*.yml","*.yaml")'
    description: >
      PowerShell string array of file name patterns to include when evaluating GHA files, e.g. '@("*.yml")' or
      '@("*.yml", "*.yaml")'. The parameter must be a PowerShell string array.
  called-repo-base-include-list:
    required: false
    default: '@("${{ github.repository }}")'
    description: >
      PowerShell string array of repository base URLs to include when evaluating called GHA Workflows and Actions, e.g
      '@("Lombiq/GitHub-Actions")' or '@("Lombiq/GitHub-Actions", "Lombiq/Open-Source-Orchard-Core-Extensions")'. The
      parameter must be a PowerShell string array.
  expected-ref:
    required: false
    default: ${{ github.ref_name }}
    description: The expected reference value to be used by the called GHA Workflows and Actions.
  artifact-retention-days:
    required: false
    default: '1'
    description: >
      Duration in days after which the artifact of the pending changed files (if any) will expire. See
      https://github.com/actions/upload-artifact#retention-period for more details.
runs:
  using: composite
  steps:
    - name: Setup
      id: setup
      shell: pwsh
      run: |
        '${{ github.action_path }}' >> $Env:GITHUB_PATH
        (Resolve-Path '${{ github.action_path }}/../../../Scripts').Path >> $Env:GITHUB_PATH
        Initialize-ArtifactNameSuffix '.'

    - name: Check References
      id: check-references
      shell: pwsh
      run: |
        $params = @{
            PathIncludeList = ${{ inputs.path-include-list }}
            FileIncludeList = ${{ inputs.file-include-list }}
            CalledRepoBaseIncludeList = ${{ inputs.called-repo-base-include-list }}
            ExpectedRef = "${{ inputs.expected-ref }}"
            GitHubRepository = "${{ github.repository }}"
            GitHubRefName = "${{ inputs.expected-ref }}"
        }
        Check-Called-GHA-Refs @params

    - name: Upload Files Causing Failure
      if: steps.check-references.outputs.has-files == 'true'
      uses: Lombiq/GitHub-Actions/.github/actions/upload-artifact@dev
      with:
        name: check-references-fixes-${{ steps.setup.outputs.artifact-name-suffix }}
        path: ${{ steps.check-references.outputs.artifact-path }}
        if-no-files-found: ignore
        retention-days: ${{ inputs.artifact-retention-days }}

    - name: Fail if flagged
      shell: pwsh
      run: |
        if (-not (Test-Path .gha-error))
        {
          Write-Output "Verify GitHub Actions References completed successfully."
          exit 0
        }

        $ghaError = ((Get-Content .gha-error).Replace("`n", ' ') -join ' ') -replace '\s+', ' '
        Write-GitHub "Verify GitHub Actions References failed with the following error: $ghaError"

        Remove-Item -Force .gha-error
        exit 1