# Spurvik EU AI Act unwrapped model-call check (spurvik-mcp-server@1.0.4, MIT)
# Save to: .github/workflows/spurvik-check.yml
#
# Runs a local heuristic scan across .ts/.tsx/.js/.jsx/.mjs/.cjs/.mts/.cts
# files for unwrapped OpenAI, Anthropic, Google GenAI, Vercel AI SDK, Mastra,
# OpenAI Agents, and LangGraph calls.
#
# Exit codes:
#   0 — no unwrapped calls detected by the heuristic scan
#   1 — one or more unwrapped calls found (fails the PR check)
#   2 — invalid workspace root
#
# Scope note: heuristic pattern scan only (the scan itself makes zero network calls;
# npm exec fetches spurvik-mcp-server@1.0.4 if not already installed in node_modules).
# Not a full AST trace, not legal advice, and does not classify riskTier or mark content.
# Guide: https://spurvik.com/cursor-claude-mcp-eu-ai-act

name: Spurvik AI Call Check

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  spurvik-check:
    name: Check wrapped LLM & agent calls
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Run Spurvik unwrapped-call scan (scan makes zero network calls)
        run: |
          if [ -x ./node_modules/.bin/spurvik-mcp ]; then
            ./node_modules/.bin/spurvik-mcp check . --ci
          else
            npm exec --yes --package=spurvik-mcp-server@1.0.4 -- spurvik-mcp check . --ci
          fi