action.yml

name: tods-validate
description: >-
  Validate a Transit Operational Data Standard (TODS) feed and annotate
  findings on the pull request.
branding:
  icon: check-circle
  color: green

inputs:
  path:
    description: Directory or .zip file containing the TODS files.
    required: true
  gtfs:
    description: >-
      Companion GTFS feed (directory or .zip). Leave empty if the GTFS files
      sit next to the TODS files.
    required: false
    default: ""
  fail-on:
    description: Fail the job on findings at or above this severity (error or warning).
    required: false
    default: error
  enable:
    description: >-
      Space-separated opt-in rules or categories to turn on (coverage, advisory,
      experimental, or specific rule IDs).
    required: false
    default: ""

outputs:
  error-count:
    description: Number of errors found.
    value: ${{ steps.validate.outputs.error-count }}
  warning-count:
    description: Number of warnings found.
    value: ${{ steps.validate.outputs.warning-count }}
  info-count:
    description: Number of informational findings.
    value: ${{ steps.validate.outputs.info-count }}

runs:
  using: composite
  steps:
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
      with:
        python-version: "3.13"
    - name: Install tods-validate
      shell: bash
      env:
        ACTION_PATH: ${{ github.action_path }}
      run: python3 -m pip install --quiet "$ACTION_PATH"

    - name: Validate feed
      id: validate
      shell: bash
      # Inputs are routed through env: rather than interpolated directly into
      # this run: block (CICD-21 / zizmor+semgrep template-injection): a
      # caller of this action fully controls `with:` values, so splicing them
      # into the script text before the shell sees it would let a malicious
      # caller inject arbitrary shell into this composite action's run.
      env:
        TODS_PATH: ${{ inputs.path }}
        TODS_FAIL_ON: ${{ inputs['fail-on'] }}
        TODS_GTFS: ${{ inputs.gtfs }}
        TODS_ENABLE: ${{ inputs.enable }}
      run: |
        args=("$TODS_PATH" --format github --fail-on "$TODS_FAIL_ON")
        if [ -n "$TODS_GTFS" ]; then
          args+=(--gtfs "$TODS_GTFS")
        fi
        for token in $TODS_ENABLE; do
          args+=(--enable "$token")
        done
        tods-validate "${args[@]}"