specs-validate-with-openspec.yml

name: Validate All Specs with OpenSpec (Static Validation)

on:
  push:
    branches: [main]
    paths:
      - "openspec/**"
      - "packages/specs-guardrails/validate-specs-with-openspec/**"
      - ".github/workflows/specs-validate-with-openspec.yml"
  workflow_dispatch:

jobs:
  specs-validate-with-openspec:
    name: Validate Specs with OpenSpec (Static Validation)
    runs-on: ubuntu-latest

    outputs:
      validation-status: ${{ steps.parse-result.outputs.success }}
      validation-summary-json: ${{ steps.expose-validation-summary-json.outputs.validation_summary_json }}

    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Setup bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: latest

      - name: Ensure jq is available
        run: |
          if ! command -v jq >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y jq
          fi

      - name: Install dev dependencies
        run: bun install --only dev

      - name: Run OpenSpec validation
        id: validation
        run: |
          mkdir -p .specs-validation/openspec
          bun packages/specs-guardrails/validate-specs-with-openspec/index.ts --rootDir $(pwd)/openspec/specs > .specs-validation/openspec/result.json || true

      - name: Parse validation result
        id: parse-result
        run: |
          SUCCESS=$(jq -r '.success' .specs-validation/openspec/result.json)
          EXIT_CODE=$(jq -r '.exitCode' .specs-validation/openspec/result.json)
          TOTAL_ITEMS=$(jq -r '.summary.totals.items' .specs-validation/openspec/result.json)
          PASSED=$(jq -r '.summary.totals.passed' .specs-validation/openspec/result.json)
          FAILED=$(jq -r '.summary.totals.failed' .specs-validation/openspec/result.json)

          echo "success=$SUCCESS" >> "$GITHUB_OUTPUT"
          echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
          echo "total_items=$TOTAL_ITEMS" >> "$GITHUB_OUTPUT"
          echo "passed=$PASSED" >> "$GITHUB_OUTPUT"
          echo "failed=$FAILED" >> "$GITHUB_OUTPUT"

      - name: Render validation summary
        if: always()
        run: |
          {
            echo "# 📋 OpenSpec Validation Result"
            echo ""
            echo "| Metric | Value |"
            echo "|-------|-------|"
            echo "| Status | **${{ steps.parse-result.outputs.success }}** |"
            echo "| Total items | ${{ steps.parse-result.outputs.total_items }} |"
            echo "| Passed | ✅ ${{ steps.parse-result.outputs.passed }} |"
            echo "| Failed | ❌ ${{ steps.parse-result.outputs.failed }} |"
            echo ""
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Render validation results
        if: always()
        run: |
          echo "## 📋 All Validated Specs" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Spec ID | Status | Message |" >> "$GITHUB_STEP_SUMMARY"
          echo "|---------|-------|---------|" >> "$GITHUB_STEP_SUMMARY"

          jq -r '.items[] | 
            if .valid then 
              "| \(.id) | ✅ Valid | No issues found |"
            else 
              .id as $id | .issues[] | "| \($id) | \(.level) | \(.message | gsub("\n"; " ")) |"
            end
          ' .specs-validation/openspec/result.json >> "$GITHUB_STEP_SUMMARY"

      - name: Expose validation result JSON (as base64)
        id: expose-validation-summary-json
        run: |
          SUMMARY_B64=$(base64 < .specs-validation/openspec/result.json | tr -d '\n')
          echo "validation_summary_json=$SUMMARY_B64" >> "$GITHUB_OUTPUT"

      - name: Report validation failure
        if: steps.parse-result.outputs.success == 'false'
        continue-on-error: true
        run: |
          echo "❌ OpenSpec validation failed! Please review the validation summary above and address the issues."
          echo "🤖 You can trigger the AI fix by approving the 'Fix Specs Approval (OpenSpec)' job below."
          exit 1

  specs-fix-with-ai-approval:
    name: Fix Specs with AI Approval
    needs: specs-validate-with-openspec
    if: always() && needs.specs-validate-with-openspec.outputs.validation-status == 'false'
    runs-on: ubuntu-latest
    environment:
      name: specs-fix-with-ai-approval
    steps:
      - name: Approval granted
        run: echo "Approval granted for fixing OpenSpec validation issues with AI"

  specs-fix-with-ai:
    name: Fix Specs with AI
    needs: [specs-validate-with-openspec, specs-fix-with-ai-approval]
    if: always() && needs.specs-validate-with-openspec.outputs.validation-status == 'false' && needs.specs-fix-with-ai-approval.result == 'success'
    uses: ./.github/workflows/specs-fix-with-ai.yml
    secrets: inherit
    permissions:
      contents: write
      pull-requests: write
    with:
      summary: ${{ needs.specs-validate-with-openspec.outputs.validation-summary-json }}