From 0fc1b319b2f352a77ca38e8e6bfeda0ad8edf922 Mon Sep 17 00:00:00 2001
From: Thierno Bah <bah01194151@gmail.com>
Date: Fri, 9 Oct 2026 05:47:50 +0200
Subject: [PATCH 1/2] test: qualify the published 0.2.0 release through the v1
 action

---
 .github/workflows/published-release.yml | 49 +++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/published-release.yml

diff --git a/.github/workflows/published-release.yml b/.github/workflows/published-release.yml
new file mode 100644
index 0000000..1910a5e
--- /dev/null
+++ b/.github/workflows/published-release.yml
@@ -0,0 +1,49 @@
+name: published release review
+on:
+  pull_request:
+    branches: [qualification/published-release]
+permissions:
+  contents: read
+jobs:
+  review:
+    name: review with the published release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    concurrency:
+      group: rootform-published-review-${{ github.event.pull_request.number }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: rootform-dev/rootform
+          ref: v0.2.0
+          path: fixtures/rootform
+          sparse-checkout: examples/playground/shared-data-platform
+          persist-credentials: false
+      # Qualifies the published major tag exactly as a consumer uses it.
+      - name: Review the plan with the published release
+        id: review
+        uses: rootform-dev/action@v1
+        with:
+          version: 0.2.0
+          input: fixtures/rootform/examples/playground/shared-data-platform/base/plan.json
+          plan-file: fixtures/rootform/examples/playground/shared-data-platform/base/plan.tfplan
+          policy-pack: fixtures/negative
+          comment: "true"
+      - name: Confirm the failure is the expected Policy violation
+        if: always()
+        env:
+          EXIT_CODE: ${{ steps.review.outputs.exit-code }}
+          RESULT: ${{ steps.review.outputs.result }}
+          VERSION: ${{ steps.review.outputs.version }}
+        run: |
+          set -euo pipefail
+          test "$VERSION" = 0.2.0
+          test "$EXIT_CODE" = 1
+          jq -e '.status == "violated" and .generator.version == "0.2.0"' "$RESULT"

From 62ffad1795fb7034da180b62dd3ee90340639c73 Mon Sep 17 00:00:00 2001
From: Thierno Bah <bah01194151@gmail.com>
Date: Fri, 9 Oct 2026 06:00:46 +0200
Subject: [PATCH 2/2] test: assert the single report comment and the exact
 policy violation

---
 .github/workflows/published-release.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/published-release.yml b/.github/workflows/published-release.yml
index 1910a5e..c8a8180 100644
--- a/.github/workflows/published-release.yml
+++ b/.github/workflows/published-release.yml
@@ -11,6 +11,7 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
+      actions: read
       pull-requests: write
     concurrency:
       group: rootform-published-review-${{ github.event.pull_request.number }}
@@ -36,14 +37,25 @@ jobs:
           plan-file: fixtures/rootform/examples/playground/shared-data-platform/base/plan.tfplan
           policy-pack: fixtures/negative
           comment: "true"
-      - name: Confirm the failure is the expected Policy violation
+      - name: Confirm the reported Policy violation
         if: always()
         env:
+          GH_TOKEN: ${{ github.token }}
+          OUTCOME: ${{ steps.review.outcome }}
           EXIT_CODE: ${{ steps.review.outputs.exit-code }}
+          PR: ${{ github.event.pull_request.number }}
           RESULT: ${{ steps.review.outputs.result }}
           VERSION: ${{ steps.review.outputs.version }}
         run: |
           set -euo pipefail
+          test "$OUTCOME" = failure
           test "$VERSION" = 0.2.0
           test "$EXIT_CODE" = 1
-          jq -e '.status == "violated" and .generator.version == "0.2.0"' "$RESULT"
+          jq -e '.status == "violated" and .generator.version == "0.2.0"
+            and ([.architectures[].evaluations[] | select(.outcome == "violated")]
+              | length == 1 and .[0].policy == "qualification.policy.deny-database"
+              and .[0].address == "google_sql_database_instance.data" and .[0].stage == "planned")' "$RESULT"
+          gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments" \
+            --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- rootform-action-report:v1 -->"))) | {id, body}' |
+            jq -s . > reports.json
+          jq -e 'length == 1 and (.[0].body | contains("qualification.policy.deny-database") and contains("VIOLATED"))' reports.json