No badge, no deploy

  deploy:
    needs: [record-gate, record-gate-override]
    if: "!cancelled() && (needs.record-gate.result == 'success' || needs.record-gate-override.result == 'success')"

# .github/workflows/badge-record-gate.yml
#
# No badge, no deploy. Fails the job unless the agent's current Blueprint
# version carries a VALID Signed Agent Record under your workspace's policy: a
# verified signature under Badge's active key, a successful live run, a
# Blueprint version the record is bound to, and a record fresh enough for your
# policy. A record that merely exists does not pass.
#
# An agent with no traced Blueprint version fails with a plain reason: Badge
# has not yet seen it run, so there is nothing to bind a record to.
#
# The gate checks the Blueprint version Badge last observed, not the code in
# this pull request. Pin BADGE_BLUEPRINT_VERSION_ID in a pipeline that knows
# which version it is promoting.
#
# What the check job returns:
#   passed          job green
#   did not pass    job red, with Badge's plain-words reason
#   refused         job red, with Badge's reason: a revoked or wrong key (401, 403),
#                   no Team plan (402), a bad request (422), a wrong agent id (404),
#                   or a malformed response (a 200 without a verdict is a fault)
#   could not check job green with a warning, because Badge did not answer: a
#                   429, a 5xx, a network error, or a deployment where record gates
#                   are off. Set BADGE_RECORD_FAIL_CLOSED to true to make it red.
#                   A pull request from a fork gets no secrets, so it always reads
#                   this way; do not rely on this job as a PR check for deploys.
#
# This file has no push or tag trigger. To gate a deploy, copy the two jobs below
# into your deploy workflow, set BADGE_RECORD_FAIL_CLOSED to true there, and add:
#   needs: [record-gate, record-gate-override]
#   if: "!cancelled() && (needs.record-gate.result == 'success' || needs.record-gate-override.result == 'success')"
# to the job that deploys. Protect .github/workflows/ with CODEOWNERS, because a
# pull request can edit this gate. Keep BADGE_API_KEY a read-scope key.
#
# Break-glass: run this workflow by hand (Run workflow) and pick an override
# reason. That starts only the second job, which runs in the GitHub Environment
# badge-override. Give that Environment required reviewers and limit it to your
# default branch, and store BADGE_OVERRIDE_API_KEY there as an Environment secret:
# a key with the admin scope, owned by a workspace owner or admin. The workspace
# audit log must be on, and the override is logged there. The first job never sees
# that key, and an override that Badge does not accept leaves the job red.
#
# Repository secret:    BADGE_API_KEY               a Badge API key with the read scope
# Environment secret (badge-override):
#                       BADGE_OVERRIDE_API_KEY      an admin-scope key, used only to override
# Repository variables: BADGE_AGENT_ID              your agent's id
#                       BADGE_BLUEPRINT_VERSION_ID  optional, defaults to the current version
#                       BADGE_MAX_RECORD_AGE_DAYS   optional, 1 to 3650; can only tighten your policy's limit
#                       BADGE_RECORD_FAIL_CLOSED    optional, true or false (default false)
name: Badge record gate

on:
  pull_request:
  workflow_dispatch:
    inputs:
      override_reason:
        description: Break-glass only. Owners and admins; logged in the audit log.
        type: choice
        default: ""
        options:
          - ""
          - incident_hotfix
          - record_service_unavailable
          - key_rotation
          - other

permissions: {}

jobs:
  record-gate:
    if: github.event_name != 'workflow_dispatch' || inputs.override_reason == ''
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      outcome: ${{ steps.gate.outputs.outcome }}
    steps:
      - name: Require a valid signed Badge record
        id: gate
        env:
          BADGE_API_URL: https://api.badgeia.com
          BADGE_API_KEY: ${{ secrets.BADGE_API_KEY }}
          BADGE_AGENT_ID: ${{ vars.BADGE_AGENT_ID }}
          BADGE_BLUEPRINT_VERSION_ID: ${{ vars.BADGE_BLUEPRINT_VERSION_ID }}
          BADGE_MAX_RECORD_AGE_DAYS: ${{ vars.BADGE_MAX_RECORD_AGE_DAYS }}
          BADGE_RECORD_FAIL_CLOSED: ${{ vars.BADGE_RECORD_FAIL_CLOSED }}
        run: |
          set -uo pipefail
          TITLE="title=Badge record gate"
          CLOSED=false
          BODY=$(mktemp)
          trap 'rm -f "$BODY"' EXIT

          # One line, no secret, no forged workflow command.
          clean() {
            local text="${1//${BADGE_API_KEY:-}/[redacted]}"
            printf '%s' "$text" | tr '\r\n' '  ' | cut -c1-300
          }
          # A repository mistake, or Badge refusing the call, is a red job: a gate that
          # quietly passes on a typo or a revoked key is worse than none.
          refuse() {
            echo "outcome=error" >> "${GITHUB_OUTPUT:-/dev/null}"
            echo "::error $TITLE::$1"
            exit 1
          }
          # No verdict because Badge did not answer. Green with a warning, unless the
          # repository chose to fail closed.
          unchecked() {
            echo "outcome=could_not_check" >> "${GITHUB_OUTPUT:-/dev/null}"
            echo "Could not check: $1" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
            if [ "$CLOSED" = true ]; then
              echo "::error $TITLE::Could not check: $1. BADGE_RECORD_FAIL_CLOSED is true, so the gate stays closed."
              exit 1
            fi
            echo "::warning $TITLE::Could not check: $1. This is not a gate failure, so the job continues. Set BADGE_RECORD_FAIL_CLOSED to true to block instead."
            exit 0
          }
          # What the route said, from a body that is not trusted to be JSON.
          detail() {
            clean "$(jq -r 'if (.detail | type) == "object" then .detail.message else .detail end // empty' "$BODY" 2>/dev/null || true)"
          }

          case "${BADGE_RECORD_FAIL_CLOSED:-}" in
            true) CLOSED=true ;;
            false|"") ;;
            *) refuse "BADGE_RECORD_FAIL_CLOSED must be true or false." ;;
          esac
          if ! [[ "${BADGE_AGENT_ID:-}" =~ ^[0-9A-Fa-f-]{36}$ ]]; then
            refuse "BADGE_AGENT_ID must be set to your agent's id (a UUID)."
          fi
          VERSION="${BADGE_BLUEPRINT_VERSION_ID:-}"
          if [ "$VERSION" = auto ]; then VERSION=""; fi
          if [ -n "$VERSION" ] && ! [[ "$VERSION" =~ ^[0-9A-Fa-f-]{36}$ ]]; then
            refuse "BADGE_BLUEPRINT_VERSION_ID must be a Blueprint version id (a UUID), or empty for the current version."
          fi
          MAX_AGE="${BADGE_MAX_RECORD_AGE_DAYS:-}"
          if [ -n "$MAX_AGE" ] && { ! [[ "$MAX_AGE" =~ ^[0-9]{1,4}$ ]] || [ "$MAX_AGE" -lt 1 ] || [ "$MAX_AGE" -gt 3650 ]; }; then
            refuse "BADGE_MAX_RECORD_AGE_DAYS must be a whole number from 1 to 3650."
          fi
          if [ -z "${BADGE_API_KEY:-}" ]; then
            unchecked "BADGE_API_KEY is empty (a pull request from a fork gets no secrets)"
          fi

          REQUEST=$(jq -n --arg version "$VERSION" --arg age "$MAX_AGE" '
            {surface: "action"}
            + (if $version != "" then {blueprint_version_id: $version} else {} end)
            + (if $age != "" then {max_record_age_days: ($age | tonumber)} else {} end)')
          HTTP=$(curl -sS -o "$BODY" -w '%{http_code}' --max-time 30 -X POST \
            "$BADGE_API_URL/api/v1/agents/$BADGE_AGENT_ID/record-check" \
            -H "X-API-Key: $BADGE_API_KEY" -H "Content-Type: application/json" \
            -d "$REQUEST") || HTTP=000

          case "$HTTP" in
            200) ;;
            000) unchecked "could not reach Badge" ;;
            429) unchecked "Badge rate-limited this API key (HTTP 429)" ;;
            5??) unchecked "Badge answered HTTP $HTTP: $(detail)" ;;
            404)
              if [[ "$(detail)" == *"not enabled"* ]]; then
                unchecked "record gates are not enabled on this Badge deployment (HTTP 404)"
              fi
              refuse "HTTP 404: $(detail). The agent is unknown, or this key cannot see it." ;;
            *) refuse "Badge refused the check. HTTP $HTTP: $(detail)" ;;
          esac

          PASSED=$(jq -r 'if type == "object" and (.passed | type) == "boolean" then .passed else "invalid" end' "$BODY" 2>/dev/null || echo invalid)
          REASONS=$(jq -r '.gates[]? | select(.passed == false) | (.reason // ("gate " + (.gate // "unknown") + " failed")) | tostring | gsub("[\\r\\n]"; " ")' "$BODY" 2>/dev/null || true)
          if [ -z "$REASONS" ]; then REASONS="the gate did not pass"; fi
          case "$PASSED" in
            true)
              RECORD=$(clean "$(jq -r '.record.id // empty' "$BODY" 2>/dev/null || true)")
              echo "outcome=pass" >> "${GITHUB_OUTPUT:-/dev/null}"
              echo "Badge record gate passed${RECORD:+ (record $RECORD)}."
              echo "Badge record gate passed${RECORD:+ (record $RECORD)}." >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
              ;;
            false)
              echo "outcome=fail" >> "${GITHUB_OUTPUT:-/dev/null}"
              while IFS= read -r REASON; do
                echo "::error $TITLE::$(clean "$REASON")"
                echo "- $(clean "$REASON")" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
              done <<< "$REASONS"
              exit 1
              ;;
            *) refuse "Malformed response: Badge's answer was not the documented record-check shape." ;;
          esac

  record-gate-override:
    if: github.event_name == 'workflow_dispatch' && inputs.override_reason != ''
    runs-on: ubuntu-latest
    timeout-minutes: 5
    environment: badge-override
    outputs:
      outcome: ${{ steps.override.outputs.outcome }}
    steps:
      - name: Break-glass override of the Badge record gate
        id: override
        env:
          BADGE_API_URL: https://api.badgeia.com
          BADGE_OVERRIDE_API_KEY: ${{ secrets.BADGE_OVERRIDE_API_KEY }}
          BADGE_AGENT_ID: ${{ vars.BADGE_AGENT_ID }}
          BADGE_BLUEPRINT_VERSION_ID: ${{ vars.BADGE_BLUEPRINT_VERSION_ID }}
          BADGE_MAX_RECORD_AGE_DAYS: ${{ vars.BADGE_MAX_RECORD_AGE_DAYS }}
          BADGE_OVERRIDE_REASON: ${{ inputs.override_reason }}
        run: |
          set -uo pipefail
          TITLE="title=Badge record gate"
          BODY=$(mktemp)
          trap 'rm -f "$BODY"' EXIT

          clean() {
            local text="${1//${BADGE_OVERRIDE_API_KEY:-}/[redacted]}"
            printf '%s' "$text" | tr '\r\n' '  ' | cut -c1-300
          }
          # An override that Badge did not accept authorised nothing and wrote no audit
          # event, so every such outcome is a red job, whatever BADGE_RECORD_FAIL_CLOSED says.
          refuse() {
            echo "outcome=error" >> "${GITHUB_OUTPUT:-/dev/null}"
            echo "::error $TITLE::$1 The override was not accepted, so nothing was authorised."
            exit 1
          }
          detail() {
            clean "$(jq -r 'if (.detail | type) == "object" then .detail.message else .detail end // empty' "$BODY" 2>/dev/null || true)"
          }

          case "${BADGE_OVERRIDE_REASON:-}" in
            incident_hotfix|record_service_unavailable|key_rotation|other) ;;
            *)
              echo "outcome=error" >> "${GITHUB_OUTPUT:-/dev/null}"
              echo "::error $TITLE::The override reason must be one of: incident_hotfix, record_service_unavailable, key_rotation, other."
              exit 1 ;;
          esac
          if ! [[ "${BADGE_AGENT_ID:-}" =~ ^[0-9A-Fa-f-]{36}$ ]]; then
            refuse "BADGE_AGENT_ID must be set to your agent's id (a UUID)."
          fi
          VERSION="${BADGE_BLUEPRINT_VERSION_ID:-}"
          if [ "$VERSION" = auto ]; then VERSION=""; fi
          if [ -n "$VERSION" ] && ! [[ "$VERSION" =~ ^[0-9A-Fa-f-]{36}$ ]]; then
            refuse "BADGE_BLUEPRINT_VERSION_ID must be a Blueprint version id (a UUID), or empty for the current version."
          fi
          MAX_AGE="${BADGE_MAX_RECORD_AGE_DAYS:-}"
          if [ -n "$MAX_AGE" ] && { ! [[ "$MAX_AGE" =~ ^[0-9]{1,4}$ ]] || [ "$MAX_AGE" -lt 1 ] || [ "$MAX_AGE" -gt 3650 ]; }; then
            refuse "BADGE_MAX_RECORD_AGE_DAYS must be a whole number from 1 to 3650."
          fi
          if [ -z "${BADGE_OVERRIDE_API_KEY:-}" ]; then
            refuse "BADGE_OVERRIDE_API_KEY is empty. Store it as a secret of the badge-override Environment: a key with the admin scope, owned by a workspace owner or admin."
          fi

          REQUEST=$(jq -n --arg version "$VERSION" --arg age "$MAX_AGE" --arg override "$BADGE_OVERRIDE_REASON" '
            {surface: "action", override: {reason_code: $override}}
            + (if $version != "" then {blueprint_version_id: $version} else {} end)
            + (if $age != "" then {max_record_age_days: ($age | tonumber)} else {} end)')
          HTTP=$(curl -sS -o "$BODY" -w '%{http_code}' --max-time 30 -X POST \
            "$BADGE_API_URL/api/v1/agents/$BADGE_AGENT_ID/record-check" \
            -H "X-API-Key: $BADGE_OVERRIDE_API_KEY" -H "Content-Type: application/json" \
            -d "$REQUEST") || HTTP=000

          case "$HTTP" in
            200) ;;
            000) refuse "Badge did not answer: could not reach Badge." ;;
            *) refuse "Badge answered HTTP $HTTP: $(detail)." ;;
          esac

          PASSED=$(jq -r 'if type == "object" and (.passed | type) == "boolean" then .passed else "invalid" end' "$BODY" 2>/dev/null || echo invalid)
          REASONS=$(jq -r '.gates[]? | select(.passed == false) | (.reason // ("gate " + (.gate // "unknown") + " failed")) | tostring | gsub("[\\r\\n]"; " ")' "$BODY" 2>/dev/null || true)
          if [ -z "$REASONS" ]; then REASONS="the gate did not pass"; fi
          case "$PASSED" in
            true)
              if [ "$(jq -r '.overridden // false' "$BODY" 2>/dev/null)" = true ]; then
                echo "outcome=override" >> "${GITHUB_OUTPUT:-/dev/null}"
                echo "::warning $TITLE::Overridden ($BADGE_OVERRIDE_REASON): this job passed by break-glass override, not because the gate was met. The real result follows."
                while IFS= read -r REASON; do
                  echo "::warning $TITLE::$(clean "$REASON")"
                  echo "- $(clean "$REASON")" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
                done <<< "$REASONS"
              else
                echo "outcome=pass" >> "${GITHUB_OUTPUT:-/dev/null}"
                echo "Badge record gate passed on its merits; no override was needed."
              fi
              ;;
            false)
              echo "outcome=fail" >> "${GITHUB_OUTPUT:-/dev/null}"
              while IFS= read -r REASON; do
                echo "::error $TITLE::$(clean "$REASON")"
              done <<< "$REASONS"
              exit 1
              ;;
            *) refuse "Malformed response: Badge's answer was not the documented record-check shape." ;;
          esac

curl -sS -X POST "https://api.badgeia.com/api/v1/agents/$BADGE_AGENT_ID/record-check" \
  -H "X-API-Key: $BADGE_API_KEY" -H "Content-Type: application/json" -d '{"surface":"cli"}'