github-control-plane.yml

name: GitHub Control Plane

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  github-control-plane:
    runs-on: ubuntu-24.04
    environment: owner-approved-sensitive
    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
        with:
          clean: true
          persist-credentials: false

      - name: Run control-plane checker
        env:
          GH_TOKEN: ${{ secrets.GH_ADMIN_TOKEN || github.token }}
        run: |
          bash scripts/run_governance_py.sh scripts/check_github_control_plane.py

      - name: Upload control-plane report
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: github-control-plane-report-${{ github.run_id }}-${{ github.run_attempt }}
          retention-days: 14
          path: .runtime-cache/test_output/governance/github_control_plane_report.json
          if-no-files-found: warn