# Example: headless freeze review in CI (§K5.10 / K11).
# Vendored by overseer sync — copy to .github/workflows/freeze-review.yml in consumer repos.
#
# Secrets / variables (repository settings):
#   OVERSEER_REVIEW_API_KEY  — API bearer token (secret)
#   OVERSEER_REVIEW_API_URL  — review API base URL (variable)
#
# Degrade path: when CI is unavailable, run the same CLI locally — never treat
# unavailability as pass (§K5.10).

name: freeze-review

on:
  pull_request:
    paths:
      - "docs/**"
      - ".overseer/**"
  workflow_dispatch:
    inputs:
      freeze_path:
        description: Repo-relative freeze artifact path
        required: true
        default: docs/OVERSEER-HANDOVER.md

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install Overseer Kit CLI dependencies
        run: pip install PyYAML

      - name: Freeze review (headless API, dry-run)
        env:
          OVERSEER_REVIEW_API_KEY: ${{ secrets.OVERSEER_REVIEW_API_KEY }}
          OVERSEER_REVIEW_API_URL: ${{ vars.OVERSEER_REVIEW_API_URL }}
        run: |
          FREEZE_PATH="${{ github.event.inputs.freeze_path || 'docs/OVERSEER-HANDOVER.md' }}"
          ./cli/ok review --freeze "$FREEZE_PATH" \
            --provider api \
            --dry-run \
            --json