feat: replace the sg-cli passthrough with the Tirith Policy Check action

[refeed]

Replaces this repository's contents with an action that evaluates StackGuardian policies against a
terraform plan in CI and reports the outcome as a sticky pull-request comment and a check run.

What it supersedes

The previous action was 15 lines: a docker passthrough running sg-cli <operation> on alpine:3.10
(EOL since 2021), which wget'd the CLI's releases/latest at image build time — so pinning the
action did not pin what it ran. One free-form input, no outputs.

Anyone depending on that should pin @v1.0.0-beta; the README says so. Suggest tagging this v2
rather than moving @main.

The action is deliberately thin

Everything that talks to StackGuardian — masking, packing, uploading, polling, rendering — is
tirith platform check (StackGuardian/tirith#272). What is left here is only what is genuinely
GitHub-specific: reading the event payload, posting the comment and check run, setting outputs.

Keeping the split at that line is the point: a GitLab or Jenkins integration reuses the CLI
unchanged, and this file never becomes the place where platform behaviour is decided.

Two choices that are easy to get wrong

• TriggerDetails.type is github_action, never github_webhook. The run controller posts its
  own comment and check on the webhook path (common/vcs.py), so claiming it would double-post on
  every pull request. commentsUrl / checksApiUrl are likewise omitted.
• neutral satisfies a required check, so it is only safe for warnings. Anything unresolved maps
  to failure; approval-required maps to action_required.

Testing

The integration tests run the action as a real subprocess against a stub serving both the SG and
GitHub APIs on one port, with a real tirith installed, and assert that a secret in the plan appears
in no recorded request body and nowhere inside the uploaded archive. That end-to-end shape is
deliberate: testing the masking function in isolation is what let a leak through once already.

13 tests. Writing them caught a real defect — the trigger details were built and never passed to the
CLI, so every run would have been recorded as type: cli.

Depends on StackGuardian/tirith#272 (and the 1.2.0 tag), StackGuardian/core#1235,
StackGuardian/api#1708, StackGuardian/auth#201, StackGuardian/workflow-step-templates#310.

[Copilot]

Pull request overview

This PR replaces the previous sg-cli docker passthrough action with a composite GitHub Action wrapper around tirith platform check, adding GitHub-native reporting (sticky PR comment + check run), safer output handling, and end-to-end integration tests.

Changes:

• Replace the Docker-based sg-cli passthrough with a composite action that installs and runs Tirith.
• Add a stdlib-only Python entrypoint that translates GitHub event context into Tirith inputs and posts GitHub comment/check results.
• Add end-to-end integration tests plus updated docs/examples describing usage and migration.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
action.yml	Redefines the action as a composite action with explicit inputs/outputs and a Tirith install + execution flow.
scripts/main.py	Implements the action entrypoint: event parsing, trigger details, invoking Tirith, setting outputs, posting comment/check.
scripts/tirith_action/gh_client.py	Adds a minimal GitHub REST client to upsert a sticky comment and create a check run.
scripts/tirith_action/__init__.py	Declares the helper package.
tests/test_action_integration.py	Adds end-to-end tests validating masking/leak prevention, run creation, reporting, and exit codes.
README.md	Updates documentation for Tirith Policy Check usage, permissions, inputs/outputs, exit codes, and migration notes.
examples/basic.yml	Provides a minimal workflow example demonstrating plan → JSON → policy check.
examples/monorepo-matrix.yml	Shows recommended matrix usage with per-stack workflow-id + comment-tag.
examples/with-state.yml	Adds an example for pre-apply plan gating + post-apply state checking.
docs/terragrunt.md	Adds terragrunt pipeline guidance and phased approaches for multi-unit policy evaluation.
.github/workflows/test.yml	Updates CI to run pytest integration tests and adds a smoke test for failure behavior.
.gitignore	Ignores Python caches and pytest cache.
Dockerfile	Removed (no longer a Docker action).
entrypoint.sh	Removed (no longer used).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.