action.yml

name: "FlagLint"
description: "Enforce LaunchDarkly SDK policies and scan for flag debt in your codebase."
author: "flaglint"

branding:
  icon: flag
  color: green

inputs:
  directory:
    description: "Directory to scan"
    required: false
    default: "."
  command:
    description: "FlagLint command to run: validate | scan | audit | migrate"
    required: false
    default: "validate"
  no-direct-launchdarkly:
    description: "Fail if any direct LaunchDarkly Node server SDK calls are found (validate only)"
    required: false
    default: "true"
  extra-args:
    description: "Additional CLI flags to pass to flaglint"
    required: false
    default: ""
  version:
    description: "FlagLint version to use (e.g. latest, 1.1.0)"
    required: false
    default: "latest"
  node-version:
    description: "Node.js version to use"
    required: false
    default: "20"

runs:
  using: "composite"
  steps:
    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}

    - name: Run FlagLint
      shell: bash
      env:
        FLAGLINT_COMMAND: ${{ inputs.command }}
        FLAGLINT_DIRECTORY: ${{ inputs.directory }}
        FLAGLINT_EXTRA_ARGS: ${{ inputs.extra-args }}
        FLAGLINT_VERSION: ${{ inputs.version }}
        FLAGLINT_NO_DIRECT_LD: ${{ inputs.no-direct-launchdarkly }}
      run: |
        # Validate command against allowlist to prevent injection
        case "$FLAGLINT_COMMAND" in
          validate|scan|audit|migrate) ;;
          *) echo "Error: unsupported command '$FLAGLINT_COMMAND'. Must be one of: validate, scan, audit, migrate" >&2; exit 2 ;;
        esac

        ARGS=()
        if [ "$FLAGLINT_COMMAND" = "validate" ] && [ "$FLAGLINT_NO_DIRECT_LD" = "true" ]; then
          ARGS+=("--no-direct-launchdarkly")
        fi

        # shellcheck disable=SC2086
        npx flaglint@"$FLAGLINT_VERSION" "$FLAGLINT_COMMAND" "$FLAGLINT_DIRECTORY" "${ARGS[@]}" $FLAGLINT_EXTRA_ARGS