diffgate.yml

name: DiffGate

# PR-native review on every pull request. DiffGate reviews the PR diff against the
# base branch (--base), posts inline review comments + a `diffgate` commit status
# (--pr), and fails the check on high-impact (orange) findings so they gate merge.
#
# This is the self-contained Action path — no hosted service required. GITHUB_TOKEN
# is provided automatically by Actions; the permissions block below lets DiffGate
# post the review and set the status.

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write # post the review + inline comments
  statuses: write # set the `diffgate` commit status (the required check)

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # need the base branch to diff the PR

      - uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: DiffGate review
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # Once published to npm, replace the npx target with diffgate-review@latest.
        run: |
          npx diffgate-review@latest check \
            --base="origin/${{ github.base_ref }}" \
            --pr="${{ github.event.pull_request.number }}" \
            --no-gate

      # Optional: also review against AGENTS.md/CLAUDE.md with a hosted model.
      # Requires an API key secret; advisory (non-blocking) by default.
      # - name: DiffGate guideline review
      #   env:
      #     ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      #   run: npx diffgate-review@latest guidelines --base="origin/${{ github.base_ref }}"