From 149c7612fe57e72bb1e8b1c52fb2c925c10925f1 Mon Sep 17 00:00:00 2001
From: jochen <jochen.christ@entropy-data.com>
Date: Fri, 7 Aug 2026 09:58:11 +0200
Subject: [PATCH 1/2] Invoke the CLI directly instead of through a shell

datacontract/cli 1.1.0 moved to a shell-less hardened base image, so the
/bin/sh entrypoint fails the container before the CLI runs:

  OCI runtime create failed: exec: "/bin/sh": stat /bin/sh: no such file
  or directory

The entrypoint is now the CLI itself with a plain arg list. Since an arg
list cannot drop an entry conditionally, --publish is always passed and an
empty value means no publish (datacontract-cli#1491).
---
 action.yml | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/action.yml b/action.yml
index fd5ce93..6cfc950 100644
--- a/action.yml
+++ b/action.yml
@@ -20,13 +20,18 @@ inputs:
 runs:
   using: 'docker'
   image: 'docker://datacontract/cli:latest'
-  entrypoint: /bin/sh
+  # The image has no shell, so the CLI is invoked directly. An arg list cannot drop an
+  # entry conditionally, so `--publish` is always passed; the CLI reads an empty value
+  # as "don't publish".
+  entrypoint: datacontract
   args:
-    - -c
-    - >-
-      datacontract test
-      --server '${{ inputs.server }}'
-      --output-format junit
-      --output '${{ inputs.junit-test-report }}'
-      ${{ inputs.publish != '' && format('--publish ''{0}''', inputs.publish) || '' }}
-      '${{ inputs.location }}'
+    - test
+    - --server
+    - ${{ inputs.server }}
+    - --output-format
+    - junit
+    - --output
+    - ${{ inputs.junit-test-report }}
+    - --publish
+    - ${{ inputs.publish }}
+    - ${{ inputs.location }}

From a833cc5e880f7a47df0ce417ce54518ed9cdea8e Mon Sep 17 00:00:00 2001
From: jochen <jochen.christ@entropy-data.com>
Date: Fri, 14 Aug 2026 16:32:43 +0200
Subject: [PATCH 2/2] Pass --publish only when set; add smoke-test workflow

The released CLI (1.1.1) rejects an empty --publish value and the runner
passes empty args as literal "" instead of dropping them, so always
passing the flag breaks the default no-publish case. The publish option
is now a single conditional `--publish=<url>` arg that degrades to
`--no-logs` (the CLI default anyway) when the input is unset.

The smoke-test workflow runs the action against a local CSV contract on
every push, covering the shell-less invocation end to end.
---
 .github/workflows/test.yml | 26 ++++++++++++++++++++++++++
 action.yml                 | 10 +++++-----
 tests/data/orders.csv      |  4 ++++
 tests/datacontract.yaml    | 20 ++++++++++++++++++++
 4 files changed, 55 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/test.yml
 create mode 100644 tests/data/orders.csv
 create mode 100644 tests/datacontract.yaml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..e0d7c17
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,26 @@
+name: Test
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  smoke-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # The datacontract container runs as a non-root user and writes the JUnit
+      # report into the workspace, see README.
+      - name: Make workspace writable for datacontract container
+        run: chmod -R a+rwX "$GITHUB_WORKSPACE"
+      - name: Run action against local test contract
+        uses: ./
+        with:
+          location: tests/datacontract.yaml
+          server: production
+          junit-test-report: TEST-datacontract.xml
+      - name: Assert JUnit report was written
+        run: |
+          test -s TEST-datacontract.xml
+          grep -q 'failures="0"' TEST-datacontract.xml
+          cat TEST-datacontract.xml
diff --git a/action.yml b/action.yml
index 6cfc950..d965774 100644
--- a/action.yml
+++ b/action.yml
@@ -20,9 +20,10 @@ inputs:
 runs:
   using: 'docker'
   image: 'docker://datacontract/cli:latest'
-  # The image has no shell, so the CLI is invoked directly. An arg list cannot drop an
-  # entry conditionally, so `--publish` is always passed; the CLI reads an empty value
-  # as "don't publish".
+  # The image has no shell, so the CLI is invoked directly. The runner passes empty
+  # args as literal "" (it does not drop them) and the CLI rejects an empty --publish
+  # value, so the publish option is a single `--publish=<url>` arg that degrades to
+  # `--no-logs` (the CLI's default behavior anyway) when the input is unset.
   entrypoint: datacontract
   args:
     - test
@@ -32,6 +33,5 @@ runs:
     - junit
     - --output
     - ${{ inputs.junit-test-report }}
-    - --publish
-    - ${{ inputs.publish }}
+    - ${{ inputs.publish != '' && format('--publish={0}', inputs.publish) || '--no-logs' }}
     - ${{ inputs.location }}
diff --git a/tests/data/orders.csv b/tests/data/orders.csv
new file mode 100644
index 0000000..4b8d5be
--- /dev/null
+++ b/tests/data/orders.csv
@@ -0,0 +1,4 @@
+order_id,amount
+1,10.50
+2,20.00
+3,7.25
diff --git a/tests/datacontract.yaml b/tests/datacontract.yaml
new file mode 100644
index 0000000..ab91bdd
--- /dev/null
+++ b/tests/datacontract.yaml
@@ -0,0 +1,20 @@
+dataContractSpecification: 1.1.0
+id: datacontract-action-smoke-test
+info:
+  title: Smoke test contract for the GitHub Action
+  version: 1.0.0
+servers:
+  production:
+    type: local
+    path: tests/data/orders.csv
+    format: csv
+models:
+  orders:
+    type: table
+    fields:
+      order_id:
+        type: string
+        required: true
+        unique: true
+      amount:
+        type: decimal