# @lssm-tech/action.validation

GitHub Action for running ContractSpec CI checks

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `5.0.4`
- Package path: `packages/apps/action-validation`
- Manifest path: `packages/apps/action-validation/package.json`
- Manifest Git blob: `75aa778007c9d3edd33defe7a63211c9a3b76262`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/action.validation](https://lssm.co/docs/packages/action.validation/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/action-validation)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/action-validation/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/action-validation/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/action.validation.txt)

## Package metadata

```json
{
  "layer": "apps",
  "physicalArea": null,
  "primaryArea": "delivery-and-infrastructure",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "solutions",
    "catalogKind": "app",
    "catalogStatus": "active",
    "adoptionMode": "operator-only",
    "stability": "stable"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Delivery, infrastructure and runtime operations](https://lssm.co/docs/areas/delivery-and-infrastructure/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/apps/action-validation/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/action-validation/README.md",
  "blobSha": "98aa71ed34d19b7d1ea8e1fca06280b1b56616ee",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# @lssm-tech/action.validation

Website: https://contractspec.io

**ContractSpec GitHub Action for CI/CD integration. Wraps the `contractspec ci` CLI command as a composite action.**

## What It Does

- **Layer**: app (GitHub Action)
- **Consumers**: external CI/CD pipelines via `lssm/contractspec-action@v1`

## Usage

```yaml
name: ContractSpec CI
on: pull_request
jobs:
  contractspec:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@v6
      - uses: lssm-tech/contractspec/packages/apps/action-validation@main
        with:
          github-packages-token: ${{ secrets.CONTRACTSPEC_PACKAGES_TOKEN }}
```


For affected private GitHub Packages dependencies, `github-packages-token` must be a GitHub token that can read the ContractSpec packages granted to the consuming repository, bot, or GitHub App.

## Inputs

- `checks` (default: `all`) — Checks to run (comma-separated: structure,integrity,deps,doctor,handlers,tests) or "all"
- `skip` — Checks to skip (comma-separated)
- `pattern` — Glob pattern for spec discovery
- `fail-on-warnings` (default: `false`) — Fail the action on warnings (not just errors)
- `check-handlers` (default: `false`) — Include handler implementation checks
- `check-tests` (default: `false`) — Include test coverage checks
- `upload-sarif` (default: `true`) — Upload SARIF results to GitHub Code Scanning
- `working-directory` (default: `.`) — Working directory for running checks
- `bun-version` (default: `latest`) — Bun version to use
- `mode` (default: `validate`) — Action mode: "validate" (run checks) or "impact" (detect breaking changes)
- `baseline` — Git ref to compare against for impact detection (default: base branch from PR context)
- `pr-comment` (default: `true`) — Post impact results as PR comment
- `github-token` (default: `${{ github.token }}`) — GitHub token for PR comments and check runs
- `github-packages-token` — Optional token used to configure private GitHub Packages auth before dependency installs

## Outputs

- `success` — Whether all checks passed
- `errors` — Number of errors found
- `warnings` — Number of warnings found
- `sarif-file` — Path to SARIF output file (if uploaded)
- `json-file` — Path to JSON output file
- `impact-status` — Impact status: "no-impact" | "non-breaking" | "breaking"
- `breaking-count` — Number of breaking changes detected
- `non-breaking-count` — Number of non-breaking changes detected

## Key Files

- `action.yml` — GitHub Action definition (composite action)
- `README.md` — Usage documentation
- `package.json` — Package metadata (private, not published to npm)

## Local Commands

- `bun run test` — bun test

## Recent Updates

- Replace eslint+prettier by biomejs to optimize speed
- Stability
- PublishConfig not supported by bun

## Notes

- All input/output changes must be reflected in both `action.yml` and `README.md`.
- The action is versioned with tags on the repository — breaking input changes require a major version bump.
- Test locally using `act` or by referencing the local action: `uses: ./packages/apps/action-validation`.


## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Catalogue metadata

```json
{
  "family": "solutions",
  "kind": "app",
  "status": "active",
  "adoptionMode": "operator-only",
  "stability": "stable",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    "."
  ],
  "examples": [],
  "replacements": [],
  "nonAdoptableRationale": "This app is published for execution by operators, not as a reusable library dependency."
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/action.validation` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/action-validation/src/index.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": null,
  "files": [
    "package.json",
    "AGENTS.md",
    "CHANGELOG.md",
    "LICENSE",
    "README.md",
    "src"
  ],
  "publishExports": null
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.contracts-spec](https://lssm.co/docs/packages/lib.contracts-spec/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

No declarations in the inspected manifest.

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "test": "bun test"
}
```

## Declared documentation links

- [Action Validation documentation](https://www.npmjs.com/package/%40lssm-tech%2Faction.validation) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Faction.validation",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/action.validation.txt",
  "route": "/llms/action.validation",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/action.validation.txt",
  "blobSha": "98aa71ed34d19b7d1ea8e1fca06280b1b56616ee",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```