feat(action): JS Action for uses: intentius/github-warden@v1

.github/workflows/ci.yml

@@ -27,6 +27,8 @@ jobs:
         run: npx tsc --noEmit
       - name: test
         run: npm test
+      - name: action bundle up to date
+        run: npm run build:action && git diff --exit-code action/index.mjs
 
   dogfood-audit:
     runs-on: ubuntu-latest

README.md

@@ -55,3 +55,51 @@ Two auth modes:
 
 1. Pre-minted token: `--token-env GH_TOKEN` (e.g. from `actions/create-github-app-token`)
 2. GitHub App: `--app-id-env` + `--installation-id-env`, private key in `GOVERNANCE_APP_PRIVATE_KEY`
+
+## Use as a GitHub Action
+
+```yaml
+# Dry-run reconcile on every PR.
+- uses: intentius/github-warden@v1
+  with:
+    command: reconcile
+    config: .github/governance.yml
+    mode: dry-run
+    app-id: ${{ vars.WARDEN_APP_ID }}
+    installation-id: ${{ vars.WARDEN_INSTALLATION_ID }}
+    private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}
+
+# Apply on push to main.
+- uses: intentius/github-warden@v1
+  with:
+    command: reconcile
+    config: .github/governance.yml
+    mode: apply
+    app-id: ${{ vars.WARDEN_APP_ID }}
+    installation-id: ${{ vars.WARDEN_INSTALLATION_ID }}
+    private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}
+
+# Audit all managed repos — fail if merge-worthy findings exist.
+- uses: intentius/github-warden@v1
+  with:
+    command: audit
+    config: .github/governance.yml
+    fail-on: merge-worthy
+    app-id: ${{ vars.WARDEN_APP_ID }}
+    installation-id: ${{ vars.WARDEN_INSTALLATION_ID }}
+    private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}
+```
+
+Inputs:
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `command` | no | `reconcile` | `reconcile` or `audit` |
+| `config` | yes | — | Path to governance config (YAML/JSON) |
+| `mode` | no | `dry-run` | `dry-run` or `apply` (reconcile only) |
+| `cycles` | no | all | Comma-separated cycle names (reconcile only) |
+| `app-id` | yes | — | GitHub App ID |
+| `installation-id` | yes | — | GitHub App installation ID |
+| `private-key` | yes | — | GitHub App private key PEM — pass as a secret |
+| `fail-on` | no | `none` | `none`, `merge-worthy`, or `any` (audit only) |
+| `allow-guardrail-override` | no | `false` | Apply even when guardrails trip (reconcile only) |

action.yml

@@ -0,0 +1,61 @@
+name: github-warden
+description: >
+  Keep your GitHub org and repos in declared state — reconcile, guardrails,
+  drift correction. Runs warden's reconcile or audit subcommand as a native
+  Node.js action with GitHub App authentication.
+
+branding:
+  icon: shield
+  color: blue
+
+inputs:
+  command:
+    description: "Subcommand to run: reconcile or audit."
+    required: false
+    default: reconcile
+
+  config:
+    description: "Path to the governance config file (YAML or JSON)."
+    required: true
+
+  mode:
+    description: "Reconcile mode: dry-run or apply. Only used when command is reconcile."
+    required: false
+    default: dry-run
+
+  cycles:
+    description: >
+      Comma-separated list of cycle names to run (e.g. branch-protection).
+      Defaults to all cycles. Only used when command is reconcile.
+    required: false
+
+  app-id:
+    description: "GitHub App ID (numeric)."
+    required: true
+
+  installation-id:
+    description: "GitHub App installation ID (numeric)."
+    required: true
+
+  private-key:
+    description: "GitHub App private key in PEM format. Pass as a secret."
+    required: true
+
+  fail-on:
+    description: >
+      Audit failure threshold: none, merge-worthy, or any.
+      Exit 4 when findings exceed this level. Only used when command is audit.
+      Default: none.
+    required: false
+    default: none
+
+  allow-guardrail-override:
+    description: >
+      Set to 'true' to apply changes even when guardrails trip.
+      Only used when command is reconcile.
+    required: false
+    default: "false"
+
+runs:
+  using: node20
+  main: action/index.mjs