# Paste: Challenge CI authorize gate
#
# Companies: paste this Action into any repo that ships mutating SQL.
# DENY → Pilot Challenge Exact $100 (amount 100000000) or invoice $299/mo.
# Free ALLOW is tip only — not production authorize.
# Fail-closed hash bind: for mode=pass, Action sends expected_sql_hash
# (SHA-256 of gated SQL) to POST /v1/verify — borrowed PASS fails.

name: sqlguard-challenge-gate

on:
  pull_request:
    paths: ["**/*.sql"]
  workflow_dispatch:
    inputs:
      sql:
        description: "SQL to gate (workflow_dispatch)"
        required: true
        default: "DROP TABLE customers CASCADE"

jobs:
  authorize:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Gate mutating SQL (DENY → Challenge $100)
        id: gate
        uses: cabbageandtea/sqlguard/.github/actions/sqlguard-authorize-gate@master
        with:
          sql: ${{ github.event.inputs.sql || 'DROP TABLE customers CASCADE' }}
          mode: decide
          allow_approval: "false"

      - name: Wealth unlock on DENY
        if: failure() && steps.gate.outputs.decision == 'DENY'
        run: |
          echo "deny_id=${{ steps.gate.outputs.deny_id }}"
          echo "convert=deny_to_pilot · unlock_keys=pilot only (Session OFF TABLE)"
          echo "Unlock: POST https://sqlguard.io/v1/challenge/unlock { deny_id, agent_id } → 402 amount 100000000"
          echo "Invoice: hello@sqlguard.io · Gateway \$299/mo"
          echo "UI: https://sqlguard.io/challenge · https://sqlguard.io/buy#pilot"
          echo "Docs: https://sqlguard.io/GATEWAY.md"
          echo "response_json (convert/unlock): ${{ steps.gate.outputs.response_json }}"