From f6b3460a47e6ecc09a981e0ee4805998b54d0103 Mon Sep 17 00:00:00 2001
From: David Ibia <github@boxpositron.dev>
Date: Tue, 9 Jun 2026 05:29:43 +0100
Subject: [PATCH] fix: skip summary on empty CLI output; pin reoclo CLI
 v0.45.0; document reoclo.app label

The step summary rendered even when the CLI failed and wrote nothing to stdout
(e.g. a 400 from session creation), making jq choke and printing a spurious
'integer expression expected'. Only render the table when stdout is parseable
JSON, and default errors_count to 0.

Bump the pinned reoclo CLI to v0.45.0 (adds reoclo.app/reoclo.app-id label ->
application_ref binding; install.sh sha256 unchanged). README setup step now
documents binding by the reoclo.app label as the recommended option.
---
 README.md  |  7 +++++--
 action.yml | 13 +++++++++----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 0dd5d69..ce70ca1 100644
--- a/README.md
+++ b/README.md
@@ -22,8 +22,11 @@ downstream steps.
    enable the `external_deploy` operation scope for it.
 2. Store the key in your repository or organisation secrets:
    `Settings > Secrets > Actions > New secret`, name it `REOCLO_API_KEY`.
-3. Ensure the containers you want to sync are registered as Reoclo Applications
-   with matching `linked_container_name` values.
+3. Bind the containers you want to sync to Reoclo Applications. Either label the
+   service with `reoclo.app: <application-slug>` (recommended — identity is
+   independent of the container name), or register the Application with a
+   matching `linked_container_name` (and optionally `linked_container_names`
+   aliases or a `linked_container_name_pattern` glob).
 
 ## Usage
 
diff --git a/action.yml b/action.yml
index ec05ae6..37a7341 100644
--- a/action.yml
+++ b/action.yml
@@ -34,7 +34,7 @@ runs:
     - name: Ensure reoclo CLI
       shell: bash
       env:
-        REOCLO_PIN: v0.44.3
+        REOCLO_PIN: v0.45.0
         # SHA-256 of the pinned release's install.sh (stable across releases). The
         # installer then verifies the downloaded binary against SHA256SUMS, so this
         # gives a tamper-evident chain: pinned hash -> installer -> binary.
@@ -84,8 +84,13 @@ runs:
           echo "synced_fqdns=$(printf '%s' "$out" | jq -r '(.synced_fqdns // []) | join(",")')"
         } >> "$GITHUB_OUTPUT"
 
-        # Write step summary
-        if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+        # Write step summary — only when the CLI returned parseable JSON. A
+        # failed run (e.g. a 400 from session creation) writes its error to
+        # stderr and nothing to stdout, leaving "$out" empty; rendering the table
+        # then made `jq` choke and `[ "$errors_count" -gt 0 ]` print a spurious
+        # "integer expression expected". Skip the table in that case — the CLI's
+        # stderr already carries the real error and we still `exit $rc` below.
+        if [ -n "${GITHUB_STEP_SUMMARY:-}" ] && printf '%s' "$out" | jq -e . >/dev/null 2>&1; then
           {
             echo "## Reoclo Deploy Sync"
             echo ""
@@ -98,7 +103,7 @@ runs:
               "| \(.container_name) | \(.status) | \((.synced_fqdns // []) | join(", ") | if . == "" then "-" else . end) | \(.reason // "-") |"
             '
             errors_count="$(printf '%s' "$out" | jq -r '(.errors // []) | length')"
-            if [ "$errors_count" -gt 0 ]; then
+            if [ "${errors_count:-0}" -gt 0 ]; then
               echo ""
               echo "### Errors"
               printf '%s' "$out" | jq -r '.errors[]? | "- **\(.container_name)**: \(.reason)"'