action.yml

name: 'GitScout Security Auditor'
description: 'Statically audits your repository code and package lockfiles for security threats and malicious dependencies.'
author: 'adityazzzzz'
inputs:
  path:
    description: 'The directory path to audit (relative to the repo root).'
    required: false
    default: '.'
  github-token:
    description: 'Optional GitHub API token to bypass rate limits during remote dependency checks.'
    required: false
  fail-on-warnings:
    description: 'Set to true to fail the build if high or critical warnings are found.'
    required: false
    default: 'true'

runs:
  using: 'composite'
  steps:
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '>=1.21'
        cache: false # Disable caching inside composite action to prevent conflict with outer workflows

    - name: Build GitScout CLI
      shell: bash
      run: |
        cd "${{ github.action_path }}/backend"
        go build -o gitscout ./cmd/cli
        cp gitscout "${{ github.workspace }}/gitscout"
        chmod +x "${{ github.workspace }}/gitscout"

    - name: Run GitScout Audit
      id: audit
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
      run: |
        echo "Running GitScout Security Audit..."
        # Run scan and capture json output. Ignore exit code temporarily so we can generate step summary.
        "${{ github.workspace }}/gitscout" "${{ inputs.path }}" -json > gitscout-report.json || true
        cat gitscout-report.json

    - name: Generate Job Summary
      shell: node {0}
      env:
        REPORT_FILE: gitscout-report.json
        FAIL_ON_WARNINGS: ${{ inputs.fail-on-warnings }}
      run: |
        const fs = require('fs');
        const path = require('path');
        
        try {
          const reportPath = path.resolve(process.env.REPORT_FILE);
          if (!fs.existsSync(reportPath)) {
            console.error("GitScout report file not found.");
            process.exit(1);
          }
          
          const raw = fs.readFileSync(reportPath, 'utf8');
          const report = JSON.parse(raw);
          
          // Generate Markdown Summary for GITHUB_STEP_SUMMARY
          let md = `## 🛡️ GitScout Security Audit Results\n\n`;
          
          let scoreEmoji = "🟢";
          if (report.score < 70) scoreEmoji = "🔴";
          else if (report.score < 90) scoreEmoji = "🟡";
          
          md += `### Summary\n`;
          md += `- **Verdict**: **${report.verdict.toUpperCase()}** ${scoreEmoji}\n`;
          md += `- **Security Rating**: **${report.score}/100**\n`;
          md += `- **Files Inspected**: ${report.files_scanned}\n`;
          md += `- **Duration**: ${report.duration_ms}ms\n\n`;
          
          md += `### Threat Metrics\n`;
          md += `| Critical | High | Medium | Low |\n`;
          md += `| --- | --- | --- | --- |\n`;
          md += `| 🟥 **${report.critical}** | 🟧 **${report.high}** | 🟨 **${report.medium}** | 🟦 **${report.low}** |\n\n`;
          
          if (report.findings && report.findings.length > 0) {
            md += `### Detailed Findings\n`;
            md += `| Severity | Check ID | File | Description |\n`;
            md += `| --- | --- | --- | --- |\n`;
            
            report.findings.forEach(f => {
              let sevEmoji = "🟦";
              if (f.severity === 'critical') sevEmoji = "🟥";
              else if (f.severity === 'high') sevEmoji = "🟧";
              else if (f.severity === 'medium') sevEmoji = "🟨";
              
              md += `| ${sevEmoji} **${f.severity.toUpperCase()}** | \`${f.check_id}\` | \`${f.file || 'Local repository'}\` | ${f.description} |\n`;
            });
            md += `\n`;
          } else {
            md += `✅ **No security threats or suspicious patterns detected. Clean codebase!**\n\n`;
          }
          
          md += `*Report generated statically by [GitScout](https://gitscout.meadityazzzz.in)*\n`;
          
          fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, md);
          
          // Clean up the binary
          try {
            fs.unlinkSync(path.resolve('gitscout'));
          } catch(e) {}
          
          // Determine if we should fail the workflow run
          const failed = report.score < 80 || report.verdict === 'dangerous';
          if (failed && process.env.FAIL_ON_WARNINGS === 'true') {
            console.log("::error::GitScout security rating is below threshold. Failing build step.");
            process.exit(1);
          }
        } catch (err) {
          console.error("Failed to parse GitScout audit output:", err);
          process.exit(1);
        }