# Example: headless freeze review in CI (§K5.10 / K11).
# Copy to your consumer repo as .github/workflows/freeze-review.yml
# or vendor via overseer sync from templates/ci/freeze-review-github-actions.yml.
#
# Requires repository secrets/variables:
#   OVERSEER_REVIEW_API_KEY  (secret)
#   OVERSEER_REVIEW_API_URL    (variable — base URL of your review API)
#
# Safe default: --dry-run (no stamp write). Remove --dry-run on feature-branch gates
# when operator policy allows stamp writes in CI.

name: freeze-review

on:
  pull_request:
    paths:
      - "docs/**"
      - ".overseer/**"
  workflow_dispatch:
    inputs:
      freeze_path:
        description: Repo-relative freeze artifact path
        required: true
        default: docs/PHASE-K5-FREEZE-REVIEWER-CONTRACT.md

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install Overseer Kit CLI dependencies
        run: pip install PyYAML

      - name: Freeze review (headless API, dry-run)
        env:
          OVERSEER_REVIEW_API_KEY: ${{ secrets.OVERSEER_REVIEW_API_KEY }}
          OVERSEER_REVIEW_API_URL: ${{ vars.OVERSEER_REVIEW_API_URL }}
        run: |
          FREEZE_PATH="${{ github.event.inputs.freeze_path || 'docs/PHASE-K5-FREEZE-REVIEWER-CONTRACT.md' }}"
          ./cli/overseer review --freeze "$FREEZE_PATH" \
            --provider api \
            --dry-run \
            --json