entrypoint.sh

#!/bin/sh
# shellcheck disable=SC3037

# validate subscription status
REPO_PRIVATE=$(jq -r '.repository.private | tostring' "$GITHUB_EVENT_PATH" 2>/dev/null || echo "")
UPSTREAM="nosborn/github-action-markdown-cli"
ACTION_REPO="${GITHUB_ACTION_REPOSITORY:-}"
DOCS_URL="https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions"

echo ""
echo -e "\033[1;36mStepSecurity Maintained Action\033[0m"
echo "Secure drop-in replacement for $UPSTREAM"
if [ "$REPO_PRIVATE" = "false" ]; then
  echo -e "\033[32m✓ Free for public repositories\033[0m"
fi
echo -e "\033[36mLearn more:\033[0m $DOCS_URL"
echo ""

if [ "$REPO_PRIVATE" != "false" ]; then
  SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"

  if [ "$SERVER_URL" != "https://github.com" ]; then
    BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL")
  else
    BODY=$(printf '{"action":"%s"}' "$ACTION_REPO")
  fi

  API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription"

  RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \
    -X POST \
    -H "Content-Type: application/json" \
    -d "$BODY" \
    "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$?

  if [ "$CURL_EXIT_CODE" -ne 0 ]; then
    echo "Timeout or API not reachable. Continuing to next step."
  elif [ "$RESPONSE" = "403" ]; then
    echo -e "::error::\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m"
    echo -e "::error::\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m"
    exit 1
  fi
fi

set -- markdownlint
if [ -n "${INPUT_CONFIG_FILE}" ]; then
  set -- "$@" -c "${INPUT_CONFIG_FILE}"
fi
if [ -n "${INPUT_DOT}" ]; then
  set -- "$@" -d
fi
if [ -n "${INPUT_IGNORE_FILES}" ]; then
  set -- "$@" -i "${INPUT_IGNORE_FILES}"
fi
if [ -n "${INPUT_IGNORE_PATH}" ]; then
  set -- "$@" -p "${INPUT_IGNORE_PATH}"
fi
if [ -n "${INPUT_RULES}" ]; then
  set -- "$@" -r "${INPUT_RULES}"
fi

PROBLEM_MATCHER="$(mktemp -p "${GITHUB_WORKSPACE:?}")"
trap 'rm -f "${PROBLEM_MATCHER}"' EXIT
cp /markdownlint-problem-matcher.json "${PROBLEM_MATCHER:?}" || exit
echo "::add-matcher::${PROBLEM_MATCHER:?}"

# INPUT_FILES is intentionally word-split to support multiple space-separated paths/globs
# shellcheck disable=SC2086
npx "$@" ${INPUT_FILES:?}
readonly RC=$?

echo '::remove-matcher owner=markdownlint::'

exit "${RC}"