action.yml

name: 'pgfence'
description: 'Postgres migration safety CLI — lock mode analysis, risk scoring, and safe rewrite recipes'
author: 'Flavius Munteanu'

branding:
  icon: 'shield'
  color: 'blue'

inputs:
  path:
    description: 'Path or glob to SQL migration files'
    required: true
    default: 'migrations/*.sql'
  format:
    description: 'Migration format (auto, sql, typeorm, prisma, knex)'
    required: false
    default: 'auto'
  max-risk:
    description: 'Maximum permitted risk level (safe, low, medium, high, critical)'
    required: false
    default: 'medium'
  db-url:
    description: 'Database URL for reading pg_stat_user_tables (size-aware risk scoring)'
    required: false
  stats-file:
    description: 'Path to db stats JSON file (alternative to db-url)'
    required: false

runs:
  using: 'composite'
  steps:
    - name: Run pgfence
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        INPUT_FORMAT: ${{ inputs.format }}
        INPUT_MAX_RISK: ${{ inputs.max-risk }}
        INPUT_DB_URL: ${{ inputs.db-url }}
        INPUT_STATS_FILE: ${{ inputs.stats-file }}
      run: |
        ARGS=("$INPUT_PATH" "--ci" "--max-risk" "$INPUT_MAX_RISK")
        if [ "$INPUT_FORMAT" != "auto" ]; then
          ARGS+=("--format" "$INPUT_FORMAT")
        fi
        if [ -n "$INPUT_DB_URL" ]; then
          ARGS+=("--db-url" "$INPUT_DB_URL")
        fi
        if [ -n "$INPUT_STATS_FILE" ]; then
          ARGS+=("--stats-file" "$INPUT_STATS_FILE")
        fi

        npx --yes @flvmnt/pgfence analyze "${ARGS[@]}"