py-qa-report-action

A GitHub Action to parse pytest, bandit, and ruff results and post a comprehensive quality report as a comment on pull requests.

Contents

• Features
• Usage
  • Basic
  • Complete workflow example
  • Single tool
  • Fail on errors
  • Using outputs
• Inputs
• Outputs
• License

Features

• 📊 Comprehensive Reports - Combines pytest, bandit, and ruff results in a single PR comment
• 🔗 GitHub Integration - Clickable links directly to files and line numbers in your code
• 💬 Smart Comments - Updates existing comments instead of creating duplicates
• ✅ Flexible - Use any combination of tools, or just one
• ⚡ Fast & Lightweight - Native TypeScript with minimal dependencies

Usage

Basic

- uses: ADernild/py-qa-report-action@v1
  with:
    pytest-results: pytest-report.json
    bandit-results: bandit-report.json
    ruff-results: ruff-report.json

Complete workflow example

name: Code Quality

on:
  pull_request:
    branches: [main]

jobs:
  quality-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v6
      
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true
    
      - name: Install the project
        run: uv sync --locked --all-extras --all-groups
      
    
      - name: Run pytest
        run: uv run pytest --json-report --json-report-file=pytest-report.json
        continue-on-error: true
      
      - name: Run bandit
        run: uvx bandit -r src/ -f json -o bandit-report.json
        continue-on-error: true
      
      - name: Run ruff
        run: uvx ruff check --output-format=json src/ > ruff-report.json
        continue-on-error: true
      
      - name: Post Quality Report
        uses: ADernild/py-qa-report-action@v1
        with:
          pytest-results: pytest-report.json
          bandit-results: bandit-report.json
          ruff-results: ruff-report.json

Single tool

Use only the tools you need:

# Pytest only
- uses: ADernild/py-qa-report-action@v1
  with:
    pytest-results: pytest-report.json

# Bandit and Ruff only
- uses: ADernild/py-qa-report-action@v1
  with:
    bandit-results: bandit-report.json
    ruff-results: ruff-report.json

Fail on errors

Make the workflow fail if quality issues are found:

- uses: ADernild/py-qa-report-action@v1
  with:
    pytest-results: pytest-report.json
    bandit-results: bandit-report.json
    ruff-results: ruff-report.json
    fail-on-errors: true

Using outputs

- name: Post Quality Report
  id: qa-report
  uses: ADernild/py-qa-report-action@v1
  with:
    pytest-results: pytest-report.json
    bandit-results: bandit-report.json
    ruff-results: ruff-report.json

- name: Check results
  run: |
    echo "Comment ID: ${{ steps.qa-report.outputs.comment-id }}"
    echo "Has errors: ${{ steps.qa-report.outputs.has-errors }}"
    echo "Tests passed: ${{ steps.qa-report.outputs.pytest-passed }}"

Inputs

All inputs are optional except for github-token, which defaults to the automatic GITHUB_TOKEN.

Input	Description	Required	Default
github-token	GitHub token for posting comments. Uses the automatic token by default.	No	${{ github.token }}
pytest-results	Path to pytest JSON results file (requires pytest-json-report plugin)	No	""
bandit-results	Path to bandit JSON results file	No	""
ruff-results	Path to ruff JSON results file	No	""
fail-on-errors	Fail the workflow if errors are found (pytest failures, high/medium bandit issues, or any ruff issues)	No	false
update-comment	Update the existing report comment instead of creating a new one	No	true

Outputs

Output	Description
comment-id	ID of the comment that was created or updated
has-errors	Whether any errors were found (true or false)
pytest-passed	Number of pytest tests that passed
pytest-failed	Number of pytest tests that failed
bandit-issues	Number of bandit security issues found
ruff-issues	Number of ruff linting issues found

License

MIT License see LICENSE