action.yml

name: "Agent Maturity Compass"
description: "Score your AI agent across 8 trust surfaces in CI, fail the build below a grade, and optionally generate a signed fix plan."
branding:
  icon: "shield"
  color: "green"
inputs:
  fail-below:
    description: "Fail the job if the overall grade is below this (A+, A, A-, B+, B, B-, C+, C, C-, D+, D, D-, F)."
    required: false
    default: "B"
  fix:
    description: "Also generate a signed fix plan for any gaps (true/false)."
    required: false
    default: "false"
runs:
  using: "composite"
  steps:
    - name: Install AMC
      shell: bash
      # Pinned + checksum-verified rather than piping a moving target into a
      # shell. The previous `curl -fsSL .../install.sh | sh` executed whatever
      # the site served at that moment, in CI, with repository credentials
      # available — and this action's own README tells consumers to pin.
      run: |
        set -euo pipefail
        VERSION="1.2.0"
        BASE="https://github.com/AgentMaturity/AgentMaturityCompass/releases/download/v${VERSION}"
        curl -fsSL -o /tmp/amc.tgz "${BASE}/agent-maturity-compass-${VERSION}.tgz"
        curl -fsSL -o /tmp/SHA256SUMS "${BASE}/SHA256SUMS"
        grep "agent-maturity-compass-${VERSION}.tgz" /tmp/SHA256SUMS | (cd /tmp && sha256sum -c -)
        npm i -g /tmp/amc.tgz
    - name: Run AMC assessment
      shell: bash
      run: |
        FIX=""
        if [ "${{ inputs.fix }}" = "true" ]; then FIX="--fix"; fi
        amc run --ci --fail-below "${{ inputs.fail-below }}" $FIX