# Fail the deploy that breaks sign-in

Run it in CI. The first run writes a baseline. After that, the job fails only when a check gets worse.

1. **First run.** Backwatch checks the site and writes .backwatch.json. Commit it.
2. **Every run after.** It checks again and compares. The job fails only when a check gets worse, so existing gaps don't block you.
3. **In the job summary.** The Markdown report, with a fix prompt for each failure, lands in the run's summary.

```yaml
name: backwatch
on:
  push:
    branches: [main]
  pull_request:

jobs:
  agents:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: backwatch/backwatch@v0
        with:
          url: your-site.com
          baseline: .backwatch.json
          badge: backwatch.svg
```

## Inputs

- `url` (default none (required)): Site to check, for example your-site.com
- `baseline` (default .backwatch.json): Baseline file. Written on the first run, so commit it; the job fails on any check that got worse
- `min-score` (default empty): Fail below this overall score (0–100). Empty fails on a FAIL verdict
- `badge` (default empty): Optional badge path: .svg, or .json for a shields.io endpoint
- `version` (default 0.1): The backwatch npm version to run

## Exit codes

- `0`: Nothing got worse
- `1`: Below the threshold, or a check regressed
- `2`: Usage error
- `3`: The scan could not run