Architecture Guardian workflow (Cranot/roam-code)

name: Architecture Guardian
 
# Run the continuous architecture guardian baseline daily and on manual
# dispatch. Emits Markdown + JSON reports as workflow artifacts; the JSON
# gate step is informational (continue-on-error) so the workflow does not
# fail on advisory findings - review the uploaded artifact instead.
 
on:
  workflow_dispatch:
  schedule:
    - cron: "0 6 * * *"
 
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  guardian:
    runs-on: latchkey-small
    timeout-minutes: 20
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          cache: 'pip'
          python-version: "3.11"
 
      - name: Install roam-code
        run: |
          python -m pip install --upgrade pip
          pip install -e .
 
      - name: Build index
        run: roam init
 
      - name: Generate guardian markdown report
        run: |
          mkdir -p .roam/reports
          roam report guardian --md > .roam/reports/architecture_guardian.md
 
      - name: Run guardian gate (JSON)
        continue-on-error: true
        run: |
          roam --json report guardian > .roam/reports/architecture_guardian.json
 
      - name: Upload guardian artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: architecture-guardian
          path: .roam/reports/