Add output schema v2: split metadata/findings files

action.yml

@@ -19,7 +19,10 @@ inputs:
     required: false
     default: 'run'
   findings-file:
-    description: 'Path to structured JSON findings file to read in report mode.'
+    description: 'Path to structured JSON findings file to read in report mode. When output-schema-version is "2", this is the schema-v2 findings file.'
+    required: false
+  metadata-file:
+    description: 'Path to schema-v2 metadata JSON file to read in report mode, required alongside findings-file when output-schema-version is "2".'
     required: false
   base-config-path:
     description: 'Path to the org-wide base warden.toml file to load before the repo config (relative to repo root)'
@@ -55,6 +58,13 @@ inputs:
     description: 'Maximum number of concurrent trigger executions'
     required: false
     default: '5'
+  output-schema-version:
+    description: 'Output schema for findings-file. "2" additionally writes warden-metadata.json and warden-findings-v2.json.'
+    required: false
+    default: '1'
+  action-ref:
+    description: 'Pinned SHA/ref of this action as referenced by the calling workflow, recorded in schema v2 metadata as harness.actionRef'
+    required: false
 
 outputs:
   findings-count:
@@ -67,8 +77,14 @@ outputs:
     description: 'Summary of the analysis'
     value: ${{ steps.warden.outputs.summary }}
   findings-file:
-    description: 'Path to structured JSON findings file (always written, use for upload to GCS/S3/etc.)'
+    description: 'Path to structured JSON findings file (always written, use for upload to GCS/S3/etc.). When output-schema-version is "2", this is the schema-v2 findings file, matching the findings-file input.'
     value: ${{ steps.warden.outputs.findings-file }}
+  metadata-file:
+    description: 'Path to schema-v2 metadata JSON file (only written when output-schema-version is "2")'
+    value: ${{ steps.warden.outputs.metadata-file }}
+  findings-file-v2:
+    description: 'Path to schema-v2 findings JSON file (only written when output-schema-version is "2")'
+    value: ${{ steps.warden.outputs.findings-file-v2 }}
 
 runs:
   using: 'composite'
@@ -81,6 +97,7 @@ runs:
         INPUT_GITHUB_TOKEN: ${{ inputs.github-token }}
         INPUT_MODE: ${{ inputs.mode }}
         INPUT_FINDINGS_FILE: ${{ inputs.findings-file }}
+        INPUT_METADATA_FILE: ${{ inputs.metadata-file }}
         INPUT_BASE_CONFIG_PATH: ${{ inputs.base-config-path }}
         INPUT_BASE_SKILL_ROOT: ${{ inputs.base-skill-root }}
         INPUT_CONFIG_PATH: ${{ inputs.config-path }}
@@ -90,4 +107,6 @@ runs:
         INPUT_REQUEST_CHANGES: ${{ inputs.request-changes }}
         INPUT_FAIL_CHECK: ${{ inputs.fail-check }}
         INPUT_PARALLEL: ${{ inputs.parallel }}
+        INPUT_OUTPUT_SCHEMA_VERSION: ${{ inputs.output-schema-version }}
+        INPUT_ACTION_REF: ${{ inputs.action-ref }}
       run: node ${{ github.action_path }}/dist/action/index.js

packages/warden/src/action/inputs.test.ts

@@ -155,6 +155,28 @@ describe('parseActionInputs', () => {
       expect(() => parseActionInputs()).toThrow('Invalid mode "later"');
     });
   });
+
+  describe('output-schema-version handling', () => {
+    it('defaults to schema version 1', () => {
+      const inputs = parseActionInputs();
+      expect(inputs.outputSchemaVersion).toBe('1');
+    });
+
+    it('parses output-schema-version 2, metadata-file, and action-ref', () => {
+      process.env['INPUT_OUTPUT_SCHEMA_VERSION'] = '2';
+      process.env['INPUT_METADATA_FILE'] = 'warden-metadata.json';
+      process.env['INPUT_ACTION_REF'] = 'abc123';
+      const inputs = parseActionInputs();
+      expect(inputs.outputSchemaVersion).toBe('2');
+      expect(inputs.metadataFile).toBe('warden-metadata.json');
+      expect(inputs.actionRef).toBe('abc123');
+    });
+
+    it('rejects an invalid output-schema-version', () => {
+      process.env['INPUT_OUTPUT_SCHEMA_VERSION'] = '3';
+      expect(() => parseActionInputs()).toThrow('Invalid output-schema-version "3"');
+    });
+  });
 });
 
 describe('setupAuthEnv', () => {
@@ -173,6 +195,7 @@ describe('setupAuthEnv', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     });
     expect(process.env['ANTHROPIC_API_KEY']).toBe('sk-ant-api-key');
     expect(process.env['WARDEN_ANTHROPIC_API_KEY']).toBe('sk-ant-api-key');
@@ -188,6 +211,7 @@ describe('setupAuthEnv', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     });
     expect(process.env['CLAUDE_CODE_OAUTH_TOKEN']).toBe('sk-ant-oat-oauth-token');
     expect(process.env['ANTHROPIC_API_KEY']).toBeUndefined();
@@ -206,6 +230,7 @@ describe('setupAuthEnv', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     });
 
     expect(process.env['CLAUDE_CODE_OAUTH_TOKEN']).toBe('sk-ant-oat-oauth-token');
@@ -226,6 +251,7 @@ describe('setupAuthEnv', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     });
 
     expect(process.env['CLAUDE_CODE_OAUTH_TOKEN']).toBeUndefined();
@@ -245,6 +271,7 @@ describe('validateInputs', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     })).toThrow('base-skill-root requires base-config-path');
   });
 
@@ -257,6 +284,35 @@ describe('validateInputs', () => {
       configPath: 'warden.toml',
       maxFindings: 50,
       parallel: 4,
+      outputSchemaVersion: '1',
     })).toThrow('findings-file is required when mode is report');
   });
+
+  it('requires metadata-file in report mode when output-schema-version is 2', () => {
+    expect(() => validateInputs({
+      anthropicApiKey: 'sk-ant-api-key',
+      oauthToken: '',
+      githubToken: 'test',
+      mode: 'report',
+      configPath: 'warden.toml',
+      maxFindings: 50,
+      parallel: 4,
+      outputSchemaVersion: '2',
+      findingsFile: 'warden-findings-v2.json',
+    })).toThrow("metadata-file is required when mode is report and output-schema-version is '2'");
+  });
+
+  it('does not require metadata-file in report mode when output-schema-version is 1', () => {
+    expect(() => validateInputs({
+      anthropicApiKey: 'sk-ant-api-key',
+      oauthToken: '',
+      githubToken: 'test',
+      mode: 'report',
+      configPath: 'warden.toml',
+      maxFindings: 50,
+      parallel: 4,
+      outputSchemaVersion: '1',
+      findingsFile: 'warden-findings.json',
+    })).not.toThrow();
+  });
 });

packages/warden/src/action/inputs.ts

@@ -24,6 +24,8 @@ export interface ActionInputs {
   mode: ActionMode;
   /** Structured findings file used by report mode */
   findingsFile?: string;
+  /** Schema-v2 metadata file used by report mode when outputSchemaVersion is '2' */
+  metadataFile?: string;
   /** Optional org-wide base config that is loaded before the repo config */
   baseConfigPath?: string;
   /** Optional repo root containing org-shared local skills for the base config */
@@ -39,6 +41,10 @@ export interface ActionInputs {
   failCheck?: boolean;
   /** Max concurrent trigger executions */
   parallel: number;
+  /** Output schema for the written artifacts. '2' additionally writes warden-metadata.json and warden-findings-v2.json. */
+  outputSchemaVersion: '1' | '2';
+  /** Pinned SHA/ref of the calling workflow's `uses:` line, for harness.actionRef in schema v2. */
+  actionRef?: string;
 }
 
 // -----------------------------------------------------------------------------
@@ -77,6 +83,14 @@ function parseModeInput(value: string): ActionMode {
   throw new Error(`Invalid mode "${mode}". Expected run, analyze, or report.`);
 }
 
+function parseOutputSchemaVersionInput(value: string): '1' | '2' {
+  const version = value || '1';
+  if (version === '1' || version === '2') {
+    return version;
+  }
+  throw new Error(`Invalid output-schema-version "${version}". Expected 1 or 2.`);
+}
+
 /**
  * Parse action inputs from the GitHub Actions environment.
  * Runtime-specific auth can be absent here; runtime setup validates it when needed.
@@ -112,12 +126,15 @@ export function parseActionInputs(): ActionInputs {
   const requestChanges = parseBooleanInput(getInput('request-changes'));
   const failCheck = parseBooleanInput(getInput('fail-check'));
 
+  const outputSchemaVersion = parseOutputSchemaVersionInput(getInput('output-schema-version'));
+
   return {
     anthropicApiKey,
     oauthToken,
     githubToken: getInput('github-token') || process.env['GITHUB_TOKEN'] || '',
     mode: parseModeInput(getInput('mode')),
     findingsFile: getInput('findings-file') || undefined,
+    metadataFile: getInput('metadata-file') || undefined,
     baseConfigPath: getInput('base-config-path') || undefined,
     baseSkillRoot: getInput('base-skill-root') || undefined,
     configPath: getInput('config-path') || 'warden.toml',
@@ -127,6 +144,8 @@ export function parseActionInputs(): ActionInputs {
     requestChanges,
     failCheck,
     parallel: Number.isNaN(parallelParsed) ? DEFAULT_CONCURRENCY : parallelParsed,
+    outputSchemaVersion,
+    actionRef: getInput('action-ref') || undefined,
   };
 }
 
@@ -144,6 +163,9 @@ export function validateInputs(inputs: ActionInputs): void {
   if (inputs.mode === 'report' && !inputs.findingsFile) {
     throw new Error('findings-file is required when mode is report');
   }
+  if (inputs.mode === 'report' && inputs.outputSchemaVersion === '2' && !inputs.metadataFile) {
+    throw new Error('metadata-file is required when mode is report and output-schema-version is \'2\'');
+  }
 }
 
 /**

packages/warden/src/action/reporting/outcomes.ts

@@ -11,16 +11,18 @@ export type FindingOutcome =
 
 export type DedupeSource = 'warden' | 'external';
 export type DedupeMatchType = 'hash' | 'semantic';
-export type SkippedReason = 'max_findings' | 'duplicate_in_batch' | 'no_inline_location';
+export type SkippedReason = 'max_findings' | 'duplicate_in_batch' | 'no_inline_location' | 'review_not_posted';
 export type ResolvedReason = 'fix_evaluation' | 'stale_check';
 
 export const DedupeDetailSchema = z.object({
   source: z.enum(['warden', 'external']),
   matchType: z.enum(['hash', 'semantic']),
   existingFindingId: z.string().optional(),
+  existingSkillExecutionId: z.string().optional(),
   existingCommentId: z.number().int().positive().optional(),
   existingThreadId: z.string().optional(),
   existingResolved: z.boolean().optional(),
+  existingSkills: z.array(z.string()).optional(),
   actor: z.string().optional(),
 });
 
@@ -29,10 +31,13 @@ export type DedupeDetail = z.infer<typeof DedupeDetailSchema>;
 interface BaseFindingObservation {
   finding: Finding;
   skill?: string;
+  skillExecutionId?: string;
 }
 
 export interface PostedFindingObservation extends BaseFindingObservation {
   outcome: 'posted';
+  githubCommentId?: number;
+  githubCommentUrl?: string;
 }
 
 export interface DedupedFindingObservation extends BaseFindingObservation {
@@ -66,29 +71,36 @@ export const FindingObservationSchema = z.discriminatedUnion('outcome', [
     outcome: z.literal('posted'),
     finding: FindingSchema,
     skill: z.string().optional(),
+    skillExecutionId: z.string().optional(),
+    githubCommentId: z.number().int().positive().optional(),
+    githubCommentUrl: z.string().optional(),
   }),
   z.object({
     outcome: z.literal('deduped'),
     finding: FindingSchema,
     skill: z.string().optional(),
+    skillExecutionId: z.string().optional(),
     dedupe: DedupeDetailSchema,
   }),
   z.object({
     outcome: z.literal('skipped'),
     finding: FindingSchema,
     skill: z.string().optional(),
-    skippedReason: z.enum(['max_findings', 'duplicate_in_batch', 'no_inline_location']),
+    skillExecutionId: z.string().optional(),
+    skippedReason: z.enum(['max_findings', 'duplicate_in_batch', 'no_inline_location', 'review_not_posted']),
   }),
   z.object({
     outcome: z.literal('resolved'),
     finding: FindingSchema,
     skill: z.string().optional(),
+    skillExecutionId: z.string().optional(),
     resolvedReason: z.enum(['fix_evaluation', 'stale_check']),
   }),
   z.object({
     outcome: z.literal('failed'),
     finding: FindingSchema,
     skill: z.string().optional(),
+    skillExecutionId: z.string().optional(),
   }),
 ]);