action.yml

name: Codex Plugin Doctor
description: Validate Codex plugin packages in GitHub Actions.

inputs:
  version:
    description: codex-plugin-doctor npm version to install.
    required: false
    default: "latest"
  path:
    description: Path to the Codex plugin package root.
    required: false
    default: "."
  runtime:
    description: Run optional MCP runtime probing.
    required: false
    default: "false"
  allow-network:
    description: Explicitly allow remote MCP runtime probes to make outbound network requests.
    required: false
    default: "false"
  allow-local-network:
    description: Explicitly allow remote MCP runtime probes to contact loopback endpoints only (localhost, 127.0.0.0/8, or ::1). Private, link-local, multicast, unspecified, reserved, and NAT64 ranges remain blocked.
    required: false
    default: "false"
  allow-session-lifecycle:
    description: Explicitly allow remote MCP runtime probing to send one state-changing session termination request when a valid session is issued.
    required: false
    default: "false"
  require-remote-reliability:
    description: Fail the validation result unless every attempted remote MCP reliability scorecard passes; this does not grant network access.
    required: false
    default: "false"
  registry-metadata:
    description: Optional local server.json file or containing directory to validate for MCP Registry readiness.
    required: false
    default: ""
  require-registry-readiness:
    description: Fail unless the configured local Registry metadata receives a pass result.
    required: false
    default: "false"
  submission:
    description: Generate offline public directory submission preflight JSON and Markdown reports.
    required: false
    default: "false"
  submission-archive:
    description: Optional existing ZIP path for offline skills-only archive submission preflight reports.
    required: false
    default: ""
  require-submission-ready:
    description: Fail unless the offline submission preflight is automatically ready; this does not replace manual review.
    required: false
    default: "false"
  installed:
    description: Validate plugins from the local Codex plugin cache.
    required: false
    default: "false"
  filter:
    description: Optional installed plugin name/path filter.
    required: false
    default: ""
  config:
    description: Optional path to .codex-doctor.json.
    required: false
    default: ""
  history:
    description: Optional JSONL path for validation history output.
    required: false
    default: ""
  policy:
    description: Optional policy preset to apply. Supported values are codex-publish, mcp-strict, and security.
    required: false
    default: ""
  profile:
    description: Optional check profile to apply. Supported values are ci, strict, and publish.
    required: false
    default: ""
  output-dir:
    description: Directory where JSON, Markdown, and SARIF reports are written.
    required: false
    default: codex-plugin-doctor-reports
  artifact-name:
    description: GitHub Actions artifact name for uploaded report files.
    required: false
    default: codex-plugin-doctor-reports
  upload-artifact:
    description: Upload the generated report directory as a workflow artifact.
    required: false
    default: "true"
  step-summary:
    description: Append the Markdown report to the GitHub Actions step summary.
    required: false
    default: "true"
  json:
    description: Write a machine-readable JSON report into the output directory.
    required: false
    default: "true"
  markdown:
    description: Write a CI-friendly Markdown summary into the output directory.
    required: false
    default: "true"
  sarif:
    description: Write SARIF output into the output directory.
    required: false
    default: "false"
  corpus:
    description: Write bundled validation corpus JSON into the output directory.
    required: false
    default: "false"
  corpus-metrics-manifest:
    description: Optional path to a private corpus metrics manifest to evaluate.
    required: false
    default: ""
  corpus-metrics-baseline:
    description: Optional path to a previous corpus metrics JSON report for regression comparison.
    required: false
    default: ""
  corpus-metrics-fail-on-regression:
    description: Fail when corpus precision or recall decreases, or false-positive share increases.
    required: false
    default: "false"
  contract:
    description: Write public output contract JSON into the output directory.
    required: false
    default: "false"
  review-bundle:
    description: Write a signed review bundle directory into the output directory.
    required: false
    default: "false"
  review-bundle-dir:
    description: Directory name for the generated review bundle inside output-dir.
    required: false
    default: review-bundle
  review-bundle-verify:
    description: Verify the generated review bundle and write a verification JSON report.
    required: false
    default: "false"
  signing-key-env:
    description: Environment variable name that contains the local HMAC signing key for review bundle artifacts.
    required: false
    default: CODEX_PLUGIN_DOCTOR_SIGNING_KEY
  review-bundle-allow-dirty:
    description: Allow dirty git worktrees when generating review bundle release evidence.
    required: false
    default: "false"
  review-bundle-allow-untagged:
    description: Allow untagged commits when generating review bundle release evidence.
    required: false
    default: "true"

outputs:
  status:
    description: Exit status returned by the primary validation run.
    value: ${{ steps.run-doctor.outputs.status }}
  report-dir:
    description: Directory containing generated Codex Plugin Doctor reports.
    value: ${{ steps.run-doctor.outputs.report-dir }}
  summary-path:
    description: Path to the generated Markdown summary report.
    value: ${{ steps.run-doctor.outputs.summary-path }}
  json-path:
    description: Path to the generated JSON report.
    value: ${{ steps.run-doctor.outputs.json-path }}
  sarif-path:
    description: Path to the generated SARIF report when sarif is enabled.
    value: ${{ steps.run-doctor.outputs.sarif-path }}
  validation-corpus-path:
    description: Path to the generated validation corpus JSON report when corpus is enabled.
    value: ${{ steps.run-doctor.outputs.validation-corpus-path }}
  corpus-metrics-path:
    description: Path to the generated corpus quality metrics JSON report when configured.
    value: ${{ steps.run-doctor.outputs.corpus-metrics-path }}
  corpus-metrics-diff-path:
    description: Path to the generated corpus quality regression JSON report when a baseline is configured.
    value: ${{ steps.run-doctor.outputs.corpus-metrics-diff-path }}
  output-contract-path:
    description: Path to the generated output contract JSON report when contract is enabled.
    value: ${{ steps.run-doctor.outputs.output-contract-path }}
  action-manifest-path:
    description: Path to the generated GitHub Action artifact manifest.
    value: ${{ steps.run-doctor.outputs.action-manifest-path }}
  registry-report-path:
    description: Path to the MCP Registry readiness JSON report when registry-metadata is configured.
    value: ${{ steps.run-doctor.outputs.registry-report-path }}
  submission-json-path:
    description: Path to the offline submission preflight JSON report when submission is enabled.
    value: ${{ steps.run-doctor.outputs.submission-json-path }}
  submission-summary-path:
    description: Path to the offline submission preflight Markdown report when submission is enabled.
    value: ${{ steps.run-doctor.outputs.submission-summary-path }}
  submission-archive-json-path:
    description: Path to the offline archive submission preflight JSON report when submission-archive is configured.
    value: ${{ steps.run-doctor.outputs.submission-archive-json-path }}
  submission-archive-summary-path:
    description: Path to the offline archive submission preflight Markdown report when submission-archive is configured.
    value: ${{ steps.run-doctor.outputs.submission-archive-summary-path }}
  review-bundle-path:
    description: Path to the generated review bundle directory when review-bundle is enabled.
    value: ${{ steps.run-doctor.outputs.review-bundle-path }}
  review-bundle-verification-path:
    description: Path to the generated review bundle verification report when review-bundle-verify is enabled.
    value: ${{ steps.run-doctor.outputs.review-bundle-verification-path }}

runs:
  using: composite
  steps:
    - name: Install Codex Plugin Doctor
      shell: bash
      run: npm install -g codex-plugin-doctor@${{ inputs.version }}

    - name: Run Codex Plugin Doctor
      id: run-doctor
      shell: bash
      env:
        ALLOW_NETWORK_INPUT: ${{ inputs['allow-network'] }}
        ALLOW_LOCAL_NETWORK_INPUT: ${{ inputs['allow-local-network'] }}
        ALLOW_SESSION_LIFECYCLE_INPUT: ${{ inputs['allow-session-lifecycle'] }}
        REQUIRE_REMOTE_RELIABILITY_INPUT: ${{ inputs['require-remote-reliability'] }}
        REGISTRY_METADATA_INPUT: ${{ inputs['registry-metadata'] }}
        REQUIRE_REGISTRY_READINESS_INPUT: ${{ inputs['require-registry-readiness'] }}
        SUBMISSION_INPUT: ${{ inputs.submission }}
        SUBMISSION_ARCHIVE_INPUT: ${{ inputs['submission-archive'] }}
        REQUIRE_SUBMISSION_READY_INPUT: ${{ inputs['require-submission-ready'] }}
        CORPUS_METRICS_MANIFEST_INPUT: ${{ inputs['corpus-metrics-manifest'] }}
        CORPUS_METRICS_BASELINE_INPUT: ${{ inputs['corpus-metrics-baseline'] }}
        CORPUS_METRICS_FAIL_ON_REGRESSION_INPUT: ${{ inputs['corpus-metrics-fail-on-regression'] }}
      run: |
        set -euo pipefail

        report_dir="${{ inputs['output-dir'] }}"
        summary_path="$report_dir/codex-plugin-doctor-summary.md"
        json_path="$report_dir/codex-plugin-doctor-report.json"
        sarif_path="$report_dir/codex-plugin-doctor.sarif"
        validation_corpus_path="$report_dir/validation-corpus.json"
        corpus_metrics_path="$report_dir/corpus-metrics.json"
        corpus_metrics_diff_path="$report_dir/corpus-metrics-diff.json"
        output_contract_path="$report_dir/output-contract.json"
        action_manifest_path="$report_dir/codex-plugin-doctor-action-manifest.json"
        registry_report_path="$report_dir/mcp-registry-readiness.json"
        submission_json_path="$report_dir/codex-plugin-doctor-submission.json"
        submission_summary_path="$report_dir/codex-plugin-doctor-submission.md"
        submission_archive_json_path="$report_dir/codex-plugin-doctor-submission-archive.json"
        submission_archive_summary_path="$report_dir/codex-plugin-doctor-submission-archive.md"
        review_bundle_path="$report_dir/${{ inputs['review-bundle-dir'] }}"
        review_bundle_verification_path="$report_dir/review-bundle-verification.json"
        status_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-status"
        submission_state_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-submission-ran"
        submission_archive_state_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-submission-archive-ran"
        status=0
        submission_ran=false
        submission_archive_ran=false
        submission_json_output=""
        submission_summary_output=""
        submission_archive_json_output=""
        submission_archive_summary_output=""
        doctor_version="$(codex-plugin-doctor --version)"

        mkdir -p "$report_dir"

        args=(check)
        history_args=()

        if [[ "${{ inputs.installed }}" == "true" ]]; then
          args+=(--installed)
          if [[ -n "${{ inputs.filter }}" ]]; then
            args+=("${{ inputs.filter }}")
          fi
        else
          args+=("${{ inputs.path }}")
        fi

        if [[ "${{ inputs.runtime }}" == "true" ]]; then
          args+=(--runtime)
        fi

        if [[ "$ALLOW_NETWORK_INPUT" == "true" ]]; then
          args+=(--allow-network)
        fi

        if [[ "$ALLOW_LOCAL_NETWORK_INPUT" == "true" ]]; then
          args+=(--allow-local-network)
        fi

        if [[ "$ALLOW_SESSION_LIFECYCLE_INPUT" == "true" ]]; then
          args+=(--allow-session-lifecycle)
        fi

        if [[ "$REQUIRE_REMOTE_RELIABILITY_INPUT" == "true" ]]; then
          args+=(--require-remote-reliability)
        fi

        if [[ -n "${{ inputs.config }}" ]]; then
          args+=(--config "${{ inputs.config }}")
        fi

        if [[ -n "${{ inputs.history }}" ]]; then
          history_args+=(--history "${{ inputs.history }}")
        fi

        if [[ -n "${{ inputs.policy }}" ]]; then
          args+=(--policy "${{ inputs.policy }}")
        fi

        if [[ -n "${{ inputs.profile }}" ]]; then
          args+=(--profile "${{ inputs.profile }}")
        fi

        record_status() {
          local code="$1"

          if [[ "$code" -ne 0 && "$status" -eq 0 ]]; then
            status="$code"
          fi
        }

        run_doctor() {
          local label="$1"
          shift

          echo "::group::$label"
          set +e
          codex-plugin-doctor "$@"
          local code="$?"
          set -e

          if [[ "$code" -ne 0 ]]; then
            echo "Codex Plugin Doctor ${label} exited with status ${code}."
          fi

          echo "::endgroup::"
          record_status "$code"
        }

        run_doctor "check" "${args[@]}" "${history_args[@]}" --no-animations

        if [[ "${{ inputs.json }}" == "true" ]]; then
          run_doctor "json report" "${args[@]}" --json --output "$json_path"
        fi

        if [[ "${{ inputs.markdown }}" == "true" ]]; then
          run_doctor "markdown summary" "${args[@]}" --markdown --output "$summary_path"
        fi

        if [[ "${{ inputs.sarif }}" == "true" ]]; then
          run_doctor "sarif report" "${args[@]}" --sarif --output "$sarif_path"
        fi

        if [[ "${{ inputs.corpus }}" == "true" ]]; then
          run_doctor "validation corpus" doctor corpus --json --output "$validation_corpus_path"
        fi

        if [[ -z "$CORPUS_METRICS_MANIFEST_INPUT" ]]; then
          if [[ -n "$CORPUS_METRICS_BASELINE_INPUT" || "$CORPUS_METRICS_FAIL_ON_REGRESSION_INPUT" == "true" ]]; then
            echo "Corpus metrics baseline and regression gating require corpus-metrics-manifest."
            record_status 2
          fi
        elif [[ -z "$CORPUS_METRICS_BASELINE_INPUT" && "$CORPUS_METRICS_FAIL_ON_REGRESSION_INPUT" == "true" ]]; then
          echo "corpus-metrics-fail-on-regression requires corpus-metrics-baseline."
          record_status 2
        else
          run_doctor "corpus metrics" doctor corpus metrics --manifest "$CORPUS_METRICS_MANIFEST_INPUT" --json --output "$corpus_metrics_path"

          if [[ -n "$CORPUS_METRICS_BASELINE_INPUT" && -f "$corpus_metrics_path" ]]; then
            corpus_metrics_diff_args=(doctor corpus metrics diff --before "$CORPUS_METRICS_BASELINE_INPUT" --after "$corpus_metrics_path" --json --output "$corpus_metrics_diff_path")

            if [[ "$CORPUS_METRICS_FAIL_ON_REGRESSION_INPUT" == "true" ]]; then
              corpus_metrics_diff_args+=(--fail-on-regression)
            fi

            run_doctor "corpus metrics regression" "${corpus_metrics_diff_args[@]}"
          fi
        fi

        if [[ "${{ inputs.contract }}" == "true" ]]; then
          run_doctor "output contract" doctor contract --json --output "$output_contract_path"
        fi

        if [[ -z "$REGISTRY_METADATA_INPUT" ]]; then
          if [[ "$REQUIRE_REGISTRY_READINESS_INPUT" == "true" ]]; then
            echo "require-registry-readiness requires registry-metadata."
            record_status 2
          fi
        else
          registry_args=(registry check "$REGISTRY_METADATA_INPUT" --json --output "$registry_report_path")
          if [[ "$REQUIRE_REGISTRY_READINESS_INPUT" == "true" ]]; then
            registry_args+=(--require-registry-readiness)
          fi
          run_doctor "MCP Registry readiness" "${registry_args[@]}"
        fi

        if [[ "$SUBMISSION_INPUT" == "true" && -n "$SUBMISSION_ARCHIVE_INPUT" ]]; then
          echo "submission and submission-archive cannot be selected together." >&2
          record_status 2
        elif [[ "$REQUIRE_SUBMISSION_READY_INPUT" == "true" && "$SUBMISSION_INPUT" != "true" && -z "$SUBMISSION_ARCHIVE_INPUT" ]]; then
          echo "require-submission-ready requires exactly one submission mode." >&2
          record_status 2
        elif [[ "$SUBMISSION_INPUT" == "true" && "${{ inputs.installed }}" == "true" ]]; then
          echo "Submission preflight requires a single package path, not installed-cache mode." >&2
          record_status 2
        elif [[ "$SUBMISSION_INPUT" == "true" ]]; then
          submission_ran=true
          submission_args=(doctor submission "${{ inputs.path }}" --json --output "$submission_json_path")
          if [[ "$REQUIRE_SUBMISSION_READY_INPUT" == "true" ]]; then
            submission_args+=(--require-ready)
          fi
          run_doctor "submission preflight" "${submission_args[@]}"
          run_doctor "submission summary" doctor submission "${{ inputs.path }}" --markdown --output "$submission_summary_path"
          submission_json_output="$submission_json_path"
          submission_summary_output="$submission_summary_path"
        elif [[ -n "$SUBMISSION_ARCHIVE_INPUT" ]]; then
          submission_archive_ran=true
          submission_archive_args=(doctor submission archive "$SUBMISSION_ARCHIVE_INPUT" --json --output "$submission_archive_json_path")
          if [[ "$REQUIRE_SUBMISSION_READY_INPUT" == "true" ]]; then
            submission_archive_args+=(--require-ready)
          fi
          run_doctor "submission archive preflight" "${submission_archive_args[@]}"
          run_doctor "submission archive summary" doctor submission archive "$SUBMISSION_ARCHIVE_INPUT" --markdown --output "$submission_archive_summary_path"
          submission_archive_json_output="$submission_archive_json_path"
          submission_archive_summary_output="$submission_archive_summary_path"
        fi

        if [[ "${{ inputs['review-bundle'] }}" == "true" ]]; then
          signing_key_env="${{ inputs['signing-key-env'] }}"

          if [[ "${{ inputs.installed }}" == "true" ]]; then
            echo "Review bundle generation requires a single package path, not installed-cache mode."
            record_status 2
          elif [[ -z "$signing_key_env" ]]; then
            echo "Review bundle generation requires signing-key-env."
            record_status 2
          elif [[ -z "${!signing_key_env:-}" ]]; then
            echo "Review bundle signing key environment variable is not set: ${signing_key_env}"
            record_status 2
          else
            review_bundle_args=(doctor review-bundle "${{ inputs.path }}" --output "$review_bundle_path" --sign-key-env "$signing_key_env")

            if [[ "${{ inputs['review-bundle-allow-dirty'] }}" == "true" ]]; then
              review_bundle_args+=(--allow-dirty)
            fi

            if [[ "${{ inputs['review-bundle-allow-untagged'] }}" == "true" ]]; then
              review_bundle_args+=(--allow-untagged)
            fi

            run_doctor "review bundle" "${review_bundle_args[@]}"

            if [[ "${{ inputs['review-bundle-verify'] }}" == "true" ]]; then
              run_doctor "review bundle verification" doctor review-bundle verify "$review_bundle_path" --target "${{ inputs.path }}" --sign-key-env "$signing_key_env" --json --output "$review_bundle_verification_path"
            fi
          fi
        fi

        export CODEX_PLUGIN_DOCTOR_ACTION_MANIFEST_PATH="$action_manifest_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_STATUS="$status"
        export CODEX_PLUGIN_DOCTOR_ACTION_VERSION="$doctor_version"
        export CODEX_PLUGIN_DOCTOR_ACTION_REPORT_DIR="$report_dir"
        export CODEX_PLUGIN_DOCTOR_ACTION_ARTIFACT_NAME="${{ inputs['artifact-name'] }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_PATH="${{ inputs.path }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_INSTALLED="${{ inputs.installed }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_RUNTIME="${{ inputs.runtime }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_JSON="${{ inputs.json }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_MARKDOWN="${{ inputs.markdown }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_SARIF="${{ inputs.sarif }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS="${{ inputs.corpus }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS="$([[ -n "$CORPUS_METRICS_MANIFEST_INPUT" ]] && echo true || echo false)"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_DIFF="$([[ -n "$CORPUS_METRICS_BASELINE_INPUT" ]] && echo true || echo false)"
        export CODEX_PLUGIN_DOCTOR_ACTION_CONTRACT="${{ inputs.contract }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_REGISTRY="$([[ -n "$REGISTRY_METADATA_INPUT" ]] && echo true || echo false)"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION="$submission_ran"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE="$submission_archive_ran"
        export CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE="${{ inputs['review-bundle'] }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_VERIFY="${{ inputs['review-bundle-verify'] }}"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUMMARY_PATH="$summary_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_JSON_PATH="$json_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_SARIF_PATH="$sarif_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_PATH="$validation_corpus_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_PATH="$corpus_metrics_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_DIFF_PATH="$corpus_metrics_diff_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_CONTRACT_PATH="$output_contract_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_REGISTRY_PATH="$registry_report_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_JSON_PATH="$submission_json_output"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_SUMMARY_PATH="$submission_summary_output"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE_JSON_PATH="$submission_archive_json_output"
        export CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE_SUMMARY_PATH="$submission_archive_summary_output"
        export CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_PATH="$review_bundle_path"
        export CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_VERIFICATION_PATH="$review_bundle_verification_path"
        node <<'NODE'
        const fs = require("node:fs");
        const path = require("node:path");

        const enabled = (name) => process.env[name] === "true";
        const displayTargetPath = (value) => {
          if (/^file:/iu.test(value) || path.isAbsolute(value) || path.win32.isAbsolute(value)) return "[absolute-path-redacted]";
          return value === "" ? "" : path.posix.normalize(value.replace(/\\/gu, "/"));
        };
        const report = (key, enabledEnv, pathEnv) => ({
          enabled: enabled(enabledEnv),
          path: process.env[pathEnv] || ""
        });
        const manifest = {
          schemaVersion: "1.0.0",
          kind: "doctor.github.action.manifest",
          generatedAt: new Date().toISOString(),
          version: process.env.CODEX_PLUGIN_DOCTOR_ACTION_VERSION || "",
          status: Number(process.env.CODEX_PLUGIN_DOCTOR_ACTION_STATUS || "1"),
          reportDirectory: process.env.CODEX_PLUGIN_DOCTOR_ACTION_REPORT_DIR || "",
          artifactName: process.env.CODEX_PLUGIN_DOCTOR_ACTION_ARTIFACT_NAME || "",
          target: {
            path: displayTargetPath(process.env.CODEX_PLUGIN_DOCTOR_ACTION_PATH || ""),
            installed: enabled("CODEX_PLUGIN_DOCTOR_ACTION_INSTALLED"),
            runtime: enabled("CODEX_PLUGIN_DOCTOR_ACTION_RUNTIME")
          },
          reports: {
            summary: report("summary", "CODEX_PLUGIN_DOCTOR_ACTION_MARKDOWN", "CODEX_PLUGIN_DOCTOR_ACTION_SUMMARY_PATH"),
            json: report("json", "CODEX_PLUGIN_DOCTOR_ACTION_JSON", "CODEX_PLUGIN_DOCTOR_ACTION_JSON_PATH"),
            sarif: report("sarif", "CODEX_PLUGIN_DOCTOR_ACTION_SARIF", "CODEX_PLUGIN_DOCTOR_ACTION_SARIF_PATH"),
            corpus: report("corpus", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_PATH"),
            corpusMetrics: report("corpusMetrics", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_PATH"),
            corpusMetricsDiff: report("corpusMetricsDiff", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_DIFF", "CODEX_PLUGIN_DOCTOR_ACTION_CORPUS_METRICS_DIFF_PATH"),
            contract: report("contract", "CODEX_PLUGIN_DOCTOR_ACTION_CONTRACT", "CODEX_PLUGIN_DOCTOR_ACTION_CONTRACT_PATH"),
            registryReport: report("registryReport", "CODEX_PLUGIN_DOCTOR_ACTION_REGISTRY", "CODEX_PLUGIN_DOCTOR_ACTION_REGISTRY_PATH"),
            submissionJson: report("submissionJson", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_JSON_PATH"),
            submissionSummary: report("submissionSummary", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_SUMMARY_PATH"),
            submissionArchiveJson: report("submissionArchiveJson", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE_JSON_PATH"),
            submissionArchiveSummary: report("submissionArchiveSummary", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE", "CODEX_PLUGIN_DOCTOR_ACTION_SUBMISSION_ARCHIVE_SUMMARY_PATH"),
            reviewBundle: report("reviewBundle", "CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE", "CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_PATH"),
            reviewBundleVerification: report("reviewBundleVerification", "CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_VERIFY", "CODEX_PLUGIN_DOCTOR_ACTION_REVIEW_BUNDLE_VERIFICATION_PATH")
          }
        };

        fs.writeFileSync(
          process.env.CODEX_PLUGIN_DOCTOR_ACTION_MANIFEST_PATH,
          `${JSON.stringify(manifest, null, 2)}\n`,
          "utf8"
        );
        NODE

        printf "%s" "$status" > "$status_file"
        printf "%s" "$submission_ran" > "$submission_state_file"
        printf "%s" "$submission_archive_ran" > "$submission_archive_state_file"

        {
          echo "status=$status"
          echo "report-dir=$report_dir"
          echo "summary-path=$summary_path"
          echo "json-path=$json_path"
          echo "sarif-path=$sarif_path"
          echo "validation-corpus-path=$validation_corpus_path"
          echo "corpus-metrics-path=$corpus_metrics_path"
          echo "corpus-metrics-diff-path=$corpus_metrics_diff_path"
          echo "output-contract-path=$output_contract_path"
          echo "action-manifest-path=$action_manifest_path"
          echo "registry-report-path=$registry_report_path"
          echo "submission-json-path=$submission_json_output"
          echo "submission-summary-path=$submission_summary_output"
          echo "submission-archive-json-path=$submission_archive_json_output"
          echo "submission-archive-summary-path=$submission_archive_summary_output"
          echo "review-bundle-path=$review_bundle_path"
          echo "review-bundle-verification-path=$review_bundle_verification_path"
        } >> "$GITHUB_OUTPUT"

    - name: Publish Codex Plugin Doctor summary
      if: ${{ always() && inputs['step-summary'] == 'true' }}
      shell: bash
      run: |
        set -euo pipefail

        report_dir="${{ inputs['output-dir'] }}"
        summary_path="$report_dir/codex-plugin-doctor-summary.md"
        submission_summary_path="$report_dir/codex-plugin-doctor-submission.md"
        submission_archive_summary_path="$report_dir/codex-plugin-doctor-submission-archive.md"
        status_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-status"
        submission_state_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-submission-ran"
        submission_archive_state_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-submission-archive-ran"
        status="unknown"
        submission_ran=false
        submission_archive_ran=false

        if [[ -f "$status_file" ]]; then
          status="$(cat "$status_file")"
        fi

        if [[ -f "$submission_state_file" ]]; then
          submission_ran="$(cat "$submission_state_file")"
        fi

        if [[ -f "$submission_archive_state_file" ]]; then
          submission_archive_ran="$(cat "$submission_archive_state_file")"
        fi

        if [[ -n "${GITHUB_STEP_SUMMARY:-}" && -f "$summary_path" ]]; then
          cat "$summary_path" >> "$GITHUB_STEP_SUMMARY"
        fi

        if [[ -n "${GITHUB_STEP_SUMMARY:-}" && "$submission_ran" == "true" && -f "$submission_summary_path" ]]; then
          cat "$submission_summary_path" >> "$GITHUB_STEP_SUMMARY"
        fi

        if [[ -n "${GITHUB_STEP_SUMMARY:-}" && "$submission_archive_ran" == "true" && -f "$submission_archive_summary_path" ]]; then
          cat "$submission_archive_summary_path" >> "$GITHUB_STEP_SUMMARY"
        fi

        if [[ -n "${GITHUB_STEP_SUMMARY:-}" && ! -f "$summary_path" && ( "$submission_ran" != "true" || ! -f "$submission_summary_path" ) && ( "$submission_archive_ran" != "true" || ! -f "$submission_archive_summary_path" ) ]]; then
          {
            echo "## Codex Plugin Doctor"
            echo ""
            echo "- Exit status: ${status}"
            echo "- Report directory: \`${report_dir}\`"
          } >> "$GITHUB_STEP_SUMMARY"
        fi

    - name: Upload Codex Plugin Doctor reports
      if: ${{ always() && inputs['upload-artifact'] == 'true' }}
      uses: actions/upload-artifact@v7
      env:
        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
      with:
        name: ${{ inputs['artifact-name'] }}
        path: ${{ inputs['output-dir'] }}
        if-no-files-found: ignore

    - name: Complete Codex Plugin Doctor
      if: always()
      shell: bash
      run: |
        set -euo pipefail

        status_file="${RUNNER_TEMP:-.}/codex-plugin-doctor-status"
        status=1

        if [[ -f "$status_file" ]]; then
          status="$(cat "$status_file")"
        fi

        exit "$status"