action.yml

name: 'MUAD''DIB Scanner'
description: 'Supply-chain threat detection for npm & PyPI. Detects malicious packages, typosquatting, credential theft, install-time RCE, and more.'
author: 'DNSZLSK'

branding:
  icon: 'shield'
  color: 'orange'

inputs:
  path:
    description: 'Path to the project to scan'
    required: false
    default: '.'
  fail-on:
    description: 'Minimum severity that fails the workflow (critical, high, medium, low, none)'
    required: false
    default: 'high'
  sarif:
    description: 'If set to a file path, generate SARIF and upload it to the GitHub Security tab (requires security-events: write). Empty = no SARIF (single scan).'
    required: false
    default: ''
  paranoid:
    description: 'Enable paranoid mode (ultra-strict detection, higher false-positive rate)'
    required: false
    default: 'false'
  version:
    description: 'Version of muaddib-scanner to install from npm (e.g. 2.11.180). Default: latest.'
    required: false
    default: 'latest'

outputs:
  risk-score:
    description: 'Risk score from 0 to 100'
    value: ${{ steps.report.outputs.risk_score }}
  risk-level:
    description: 'Risk level (SAFE / LOW / MEDIUM / HIGH / CRITICAL)'
    value: ${{ steps.report.outputs.risk_level }}
  threats-count:
    description: 'Total number of threats detected'
    value: ${{ steps.report.outputs.threats_count }}
  critical-count:
    description: 'Number of CRITICAL threats detected'
    value: ${{ steps.report.outputs.critical_count }}
  high-count:
    description: 'Number of HIGH threats detected'
    value: ${{ steps.report.outputs.high_count }}
  exit-code:
    description: 'Scan exit code (0 = passed fail-on gate, non-zero = threats at/above fail-on)'
    value: ${{ steps.scan.outputs.exit_code }}
  sarif-file:
    description: 'Path to the generated SARIF file (empty if sarif input was not set)'
    value: ${{ steps.sarif.outputs.sarif_file }}

runs:
  using: 'composite'
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6
      with:
        node-version: '20'

    - name: Install MUAD'DIB
      shell: bash
      env:
        INPUT_VERSION: ${{ inputs.version }}
      run: npm install -g "muaddib-scanner@${INPUT_VERSION}"

    - name: Run MUAD'DIB scan
      id: scan
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        INPUT_FAIL_ON: ${{ inputs.fail-on }}
        INPUT_PARANOID: ${{ inputs.paranoid }}
      run: |
        set -o pipefail
        RESULT_FILE="$RUNNER_TEMP/muaddib-result.json"

        CMD=(muaddib scan "$INPUT_PATH" --fail-on "$INPUT_FAIL_ON" --json)
        if [ "$INPUT_PARANOID" = "true" ]; then
          CMD+=(--paranoid)
        fi

        # Authoritative scan: --json gives us BOTH the machine-readable result
        # (parsed by the reporter) AND the pass/fail exit code. One scan.
        set +e
        "${CMD[@]}" > "$RESULT_FILE"
        EXIT_CODE=$?
        set -e

        echo "result_file=$RESULT_FILE" >> "$GITHUB_OUTPUT"
        echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"

    - name: Report results
      id: report
      shell: bash
      env:
        ACTION_PATH: ${{ github.action_path }}
        RESULT_FILE: ${{ steps.scan.outputs.result_file }}
      run: node "${ACTION_PATH}/scripts/action-report.cjs" "${RESULT_FILE}"

    - name: Generate SARIF
      id: sarif
      if: inputs.sarif != ''
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        INPUT_SARIF: ${{ inputs.sarif }}
        INPUT_PARANOID: ${{ inputs.paranoid }}
      run: |
        # SARIF is a separate output format from --json (the CLI emits one
        # format per run), so producing it needs a second pass. Only runs when
        # a SARIF path is requested; the common CI case above is a single scan.
        CMD=(muaddib scan "$INPUT_PATH" --fail-on none --sarif "$INPUT_SARIF")
        if [ "$INPUT_PARANOID" = "true" ]; then
          CMD+=(--paranoid)
        fi
        "${CMD[@]}" || true
        echo "sarif_file=$INPUT_SARIF" >> "$GITHUB_OUTPUT"

    - name: Upload SARIF to GitHub Security
      if: inputs.sarif != '' && always()
      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
      with:
        sarif_file: ${{ inputs.sarif }}
      continue-on-error: true

    - name: Enforce fail-on gate
      shell: bash
      env:
        EXIT_CODE: ${{ steps.scan.outputs.exit_code }}
      run: exit "$EXIT_CODE"