gha-cache-proof 1.0.0

name: "GHA Cache Proof"
description: "Check and emulate GitHub Actions cache behavior with receipt-backed local evidence."
author: "Wildmason"
branding:
  icon: "archive"
  color: "gray-dark"
inputs:
  version:
    description: "Crate version to install, or latest."
    required: false
    default: "latest"
  command:
    description: "Command to run. Use restore, save, or check-workflow."
    required: false
    default: "check-workflow"
  store:
    description: "Local cache store directory."
    required: false
    default: ".gha-cache-proof"
  workspace:
    description: "Workspace directory."
    required: false
    default: "."
  repo:
    description: "Repository root for check-workflow."
    required: false
    default: "."
  workflow:
    description: "Newline-separated workflow paths for check-workflow."
    required: false
  key:
    description: "Cache key for restore or save."
    required: false
  restore-key:
    description: "Newline-separated restore keys for restore."
    required: false
  path:
    description: "Newline-separated cache paths."
    required: false
  reference:
    description: "Current Git ref for cache scope."
    required: false
    default: "${{ github.ref }}"
  default-branch:
    description: "Default branch name."
    required: false
    default: "${{ github.event.repository.default_branch }}"
  base-ref:
    description: "Optional base ref for pull request cache access."
    required: false
  runner-os:
    description: "Runner OS: linux, windows, or macos."
    required: false
    default: "linux"
  enable-cross-os-archive:
    description: "Enable cross-OS archive versioning."
    required: false
    default: "false"
  lookup-only:
    description: "Check for a cache hit without restoring files."
    required: false
    default: "false"
  fail-on-cache-miss:
    description: "Fail restore when no cache entry matches."
    required: false
    default: "false"
  format:
    description: "Receipt format: text, json, or markdown."
    required: false
    default: "text"
  output:
    description: "Optional receipt output path."
    required: false
  strict:
    description: "Treat warnings as failures."
    required: false
    default: "false"
runs:
  using: "composite"
  steps:
    - name: "Install gha-cache-proof"
      shell: "bash"
      run: |
        if command -v gha-cache-proof >/dev/null 2>&1; then
          exit 0
        fi

        if [ "${CACHE_PROOF_VERSION}" = "latest" ]; then
          cargo install gha-cache-proof --locked
        else
          cargo install gha-cache-proof --version "${CACHE_PROOF_VERSION}" --locked
        fi
      env:
        CACHE_PROOF_VERSION: ${{ inputs.version }}
    - name: "Run gha-cache-proof"
      shell: "bash"
      run: |
        set -euo pipefail

        args=("$CACHE_PROOF_COMMAND" --store "$CACHE_PROOF_STORE" --workspace "$CACHE_PROOF_WORKSPACE")

        append_if_set() {
          local flag="$1"
          local value="$2"
          if [ -n "$value" ]; then
            args+=("$flag" "$value")
          fi
        }

        append_lines() {
          local flag="$1"
          local value="$2"
          while IFS= read -r line; do
            if [ -n "$line" ]; then
              args+=("$flag" "$line")
            fi
          done <<< "$value"
        }

        append_if_set --reference "$CACHE_PROOF_REFERENCE"
        append_if_set --default-branch "$CACHE_PROOF_DEFAULT_BRANCH"
        append_if_set --base-ref "$CACHE_PROOF_BASE_REF"
        append_if_set --runner-os "$CACHE_PROOF_RUNNER_OS"
        if [ "$CACHE_PROOF_CROSS_OS" = "true" ]; then
          args+=(--enable-cross-os-archive)
        fi

        if [ "$CACHE_PROOF_COMMAND" = "check-workflow" ]; then
          args+=(--repo "$CACHE_PROOF_REPO")
          append_lines --workflow "$CACHE_PROOF_WORKFLOW"
        else
          append_if_set --key "$CACHE_PROOF_KEY"
          append_lines --path "$CACHE_PROOF_PATH"
        fi

        if [ "$CACHE_PROOF_COMMAND" = "restore" ]; then
          append_lines --restore-key "$CACHE_PROOF_RESTORE_KEY"
          if [ "$CACHE_PROOF_LOOKUP_ONLY" = "true" ]; then
            args+=(--lookup-only)
          fi
          if [ "$CACHE_PROOF_FAIL_ON_MISS" = "true" ]; then
            args+=(--fail-on-cache-miss)
          fi
        fi

        args+=(--format "$CACHE_PROOF_FORMAT")
        append_if_set --output "$CACHE_PROOF_OUTPUT"
        if [ "$CACHE_PROOF_STRICT" = "true" ]; then
          args+=(--strict)
        fi

        gha-cache-proof "${args[@]}"
      env:
        CACHE_PROOF_COMMAND: ${{ inputs.command }}
        CACHE_PROOF_STORE: ${{ inputs.store }}
        CACHE_PROOF_WORKSPACE: ${{ inputs.workspace }}
        CACHE_PROOF_REPO: ${{ inputs.repo }}
        CACHE_PROOF_WORKFLOW: ${{ inputs.workflow }}
        CACHE_PROOF_KEY: ${{ inputs.key }}
        CACHE_PROOF_RESTORE_KEY: ${{ inputs.restore-key }}
        CACHE_PROOF_PATH: ${{ inputs.path }}
        CACHE_PROOF_REFERENCE: ${{ inputs.reference }}
        CACHE_PROOF_DEFAULT_BRANCH: ${{ inputs.default-branch }}
        CACHE_PROOF_BASE_REF: ${{ inputs.base-ref }}
        CACHE_PROOF_RUNNER_OS: ${{ inputs.runner-os }}
        CACHE_PROOF_CROSS_OS: ${{ inputs.enable-cross-os-archive }}
        CACHE_PROOF_LOOKUP_ONLY: ${{ inputs.lookup-only }}
        CACHE_PROOF_FAIL_ON_MISS: ${{ inputs.fail-on-cache-miss }}
        CACHE_PROOF_FORMAT: ${{ inputs.format }}
        CACHE_PROOF_OUTPUT: ${{ inputs.output }}
        CACHE_PROOF_STRICT: ${{ inputs.strict }}