DocsCareCI quality gate

CI quality gate

Run care in GitHub Actions, publish the report, and fail the job on failing checks.

care ships a GitHub Action that installs the verified binary and runs care status in CI. Pin it to a tag or a commit SHA. Each tag carries the matching care version, so either pin installs the right binary and verifies its cosign signature and SHA-256 first.

Minimal run

With no inputs, the action runs care status and logs the result. It does not fail the job, so this is a report-only gate.

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<sha>
      - uses: toaweme/[email protected] # runs `care status`

Failing the job

Set strict: true to fail the step when a check fails. The report is still produced first, so a failing job leaves a readable result behind.

      - uses: toaweme/[email protected]
        with:
          strict: true

Publishing the report

output writes a JSON report, and publish-url posts it to your own ingestion endpoint. Publishing mints a GitHub OIDC token with the URL's origin as the audience, so the job needs id-token: write.

jobs:
  quality:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # only for publishing
    steps:
      - uses: actions/checkout@<sha>
      - uses: toaweme/[email protected]
        with:
          strict: true                                  # fail the job, keep the report
          publish-url: https://ci.example.com/care      # POST the report here

The endpoint receives the report JSON as the POST body with an Authorization: Bearer <token> header. Set publish-url without the token permission and publishing is skipped with a warning. The report stays in the workspace even when checks fail, so a later step can upload it as an artifact.

Note

The report-path output exposes the report's location for later steps. The report stays local unless you set both publish-url and id-token: write.

Install only

install-only: true installs and verifies the binary, then stops. No status run, publish, or gate. Use it when a later step runs its own care command, since care stays on PATH.

      - uses: toaweme/[email protected]
        with:
          install-only: true
      - run: care get toaweme/care/templates/.golangci.yml

Action inputs

None are required.

Input	Purpose	Default
`install-only`	`true` installs and verifies `care`, then stops with no status run, publish, or gate	`false`
`version`	Override the binary version, only when pinning the action to a SHA or branch	Latest
`output`	Report file path (use a `<name>.care.json` name). A failing check still writes it	none
`strict`	`true` fails the step when a check fails, after any report is published	`false`
`verify`	Cosign signature check	`true`
`dir`	Directory care runs in, for a module in a subdirectory with its own `go.mod`	`.`
`publish-url`	Full URL to POST the report to. Needs `id-token: write`	none
`publish-timeout`	Max seconds for each publish curl call	`30`

Pin to an exact tag and bump it deliberately when you adopt a new release.

Edit or read the source on GitHub