name: Dependency Guard
description: Verify npm dependencies before allowing lifecycle scripts
inputs:
  path:
    description: Path to the npm project
    required: false
    default: .
  policy:
    description: Path to the dependency-guard policy JSON
    required: false
    default: ""
  report:
    description: Path for the JSON evidence report
    required: false
    default: dependency-guard-report.json
  skip-install:
    description: Skip npm ci and npm audit commands
    required: false
    default: "false"
runs:
  using: composite
  steps:
    - name: Check Node.js version
      shell: bash
      run: node -e 'const major=Number(process.versions.node.split(".")[0]); if(major<20) throw new Error("dependency-guard requires Node.js 20 or newer")'
    - name: Verify dependencies
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        INPUT_POLICY: ${{ inputs.policy }}
        INPUT_REPORT: ${{ inputs.report }}
        INPUT_SKIP_INSTALL: ${{ inputs.skip-install }}
      run: |
        args=(check --path "$INPUT_PATH" --report "$INPUT_REPORT")
        if [[ -n "$INPUT_POLICY" ]]; then args+=(--policy "$INPUT_POLICY"); fi
        if [[ "$INPUT_SKIP_INSTALL" == "true" ]]; then args+=(--skip-install); fi
        node "$GITHUB_ACTION_PATH/bin/dependency-guard.js" "${args[@]}"