name: Agent Approval Check
description: |
  Require N human approvals on PRs that contain agent-authored commits
  (Claude, Claude Code, or any configured bot identity). Posts an
  `agent-approval-check` commit status — mark it as a required check on
  protected branches to gate merges.

inputs:
  github_token:
    description: Token with statuses:write and pull-requests:write on this repo.
    default: ${{ github.token }}
  required_approvals:
    description: Number of distinct human approvals required. Must be >= 1.
    default: "2"
  agent_emails:
    description: Comma-separated committer emails treated as agent-authored.
    default: noreply@anthropic.com
  agent_logins:
    description: |
      Comma-separated GitHub logins treated as agents — a PR opened by, or an
      APPROVED review from, one of these triggers the check.
    default: claude[bot],claude-code[bot]
  excluded_approvers:
    description: Comma-separated logins whose approvals never count (e.g. rubber-stamp bots).
    default: ""
  exempt_head_branches:
    description: |
      Comma-separated glob patterns; PRs from matching head branches auto-pass.
      WARNING: leave empty — branch names are attacker-controlled, so this is
      not a safe place to encode trust.
    default: ""
  exempt_path_prefixes:
    description: Comma-separated path prefixes; PRs touching only these auto-pass.
    default: ""
  protected_bases:
    description: |
      Comma-separated base branches this check gates. Empty = the repo's
      default branch only. PRs targeting any other base are refused (no
      status posted) so a sibling PR sharing the head SHA can't get the
      shared commit stamped green.
    default: ""
  config_file:
    description: Optional path to an agent-identities YAML file (overrides the inline inputs).
    default: ""
  docs_url:
    description: Link shown in the PR comment footer.
    default: "https://github.com/anthropics/claude-code-action/tree/main/agent-approval-check"

runs:
  using: composite
  steps:
    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
      with:
        python-version: "3.12"
    - run: pip install 'httpx==0.28.1' 'pyyaml==6.0.3' 'tenacity==9.1.4'
      shell: bash
    - run: python "${{ github.action_path }}/agent_approval_check.py"
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.github_token }}
        GH_REPOSITORY: ${{ github.repository }}
        GH_EVENT_NAME: ${{ github.event_name }}
        GH_EVENT_PATH: ${{ github.event_path }}
        REQUIRED_APPROVALS: ${{ inputs.required_approvals }}
        AGENT_EMAILS: ${{ inputs.agent_emails }}
        AGENT_LOGINS: ${{ inputs.agent_logins }}
        EXCLUDED_APPROVERS: ${{ inputs.excluded_approvers }}
        EXEMPT_HEAD_BRANCHES: ${{ inputs.exempt_head_branches }}
        EXEMPT_PATH_PREFIXES: ${{ inputs.exempt_path_prefixes }}
        PROTECTED_BASES: ${{ inputs.protected_bases }}
        CONFIG_FILE: ${{ inputs.config_file }}
        DOCS_URL: ${{ inputs.docs_url }}