name: Repo Boundary Audit

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install boundary audit dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends ripgrep

      - name: Run Boundary Audit (report mode)
        run: |
          ./scripts/audit-private-boundary.sh | tee repo-boundary-audit.txt

      - name: Enforce API Import Boundary
        run: ./scripts/audit-private-boundary.sh --enforce-api-imports

      - name: Enforce API Root Import Boundary
        run: ./scripts/audit-private-boundary.sh --enforce-api-root-imports

      - name: Enforce Non-API Import Boundary
        run: ./scripts/audit-private-boundary.sh --enforce-nonapi-imports

      - name: Enforce API pkg/licensing Bridge Boundary
        run: ./scripts/audit-private-boundary.sh --enforce-api-pkg-licensing-imports

      - name: Enforce Paid Surface Allowlist Integrity
        run: ./scripts/audit-private-boundary.sh --enforce-paid-surface-allowlist

      - name: Enforce No Paid-Domain Leaks Outside Allowlist
        run: ./scripts/audit-private-boundary.sh --enforce

      - name: Upload Audit Report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: repo-boundary-audit
          path: repo-boundary-audit.txt