From cdb1460971c5e0c2688b74113ede883ecb1c8a7f Mon Sep 17 00:00:00 2001
From: baht <44367278+soulbah@users.noreply.github.com>
Date: Sun, 11 Oct 2026 07:57:24 +0200
Subject: [PATCH] test: qualify the published 0.2.1 release through the v1
 action

---
 .github/workflows/published-release.yml | 61 +++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/published-release.yml

diff --git a/.github/workflows/published-release.yml b/.github/workflows/published-release.yml
new file mode 100644
index 0000000..deddbc0
--- /dev/null
+++ b/.github/workflows/published-release.yml
@@ -0,0 +1,61 @@
+name: published release review
+on:
+  pull_request:
+    branches: [qualification/published-release]
+permissions:
+  contents: read
+jobs:
+  review:
+    name: review with the published release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    concurrency:
+      group: rootform-published-review-${{ github.event.pull_request.number }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: rootform-dev/rootform
+          ref: v0.2.1
+          path: fixtures/rootform
+          sparse-checkout: examples/playground/shared-data-platform
+          persist-credentials: false
+      # Qualifies the published major tag exactly as a consumer uses it.
+      - name: Review the plan with the published release
+        id: review
+        uses: rootform-dev/action@v1
+        with:
+          version: 0.2.1
+          input: fixtures/rootform/examples/playground/shared-data-platform/base/plan.json
+          plan-file: fixtures/rootform/examples/playground/shared-data-platform/base/plan.tfplan
+          policy-pack: fixtures/negative
+          comment: "true"
+      - name: Confirm the reported Policy violation
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          OUTCOME: ${{ steps.review.outcome }}
+          EXIT_CODE: ${{ steps.review.outputs.exit-code }}
+          PR: ${{ github.event.pull_request.number }}
+          RESULT: ${{ steps.review.outputs.result }}
+          VERSION: ${{ steps.review.outputs.version }}
+        run: |
+          set -euo pipefail
+          test "$OUTCOME" = failure
+          test "$VERSION" = 0.2.1
+          test "$EXIT_CODE" = 1
+          jq -e '.status == "violated" and .generator.version == "0.2.1"
+            and ([.architectures[].evaluations[] | select(.outcome == "violated")]
+              | length == 1 and .[0].policy == "qualification.policy.deny-database"
+              and .[0].address == "google_sql_database_instance.data" and .[0].stage == "planned")' "$RESULT"
+          gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments" \
+            --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- rootform-action-report:v1 -->"))) | {id, body}' |
+            jq -s . > reports.json
+          jq -e 'length == 1 and (.[0].body | contains("qualification.policy.deny-database") and contains("VIOLATED"))' reports.json