action.yml

name: Evaluation adapter
description: Normalize one immutable scanner invocation and its raw SARIF into the v1 Evaluation Result.

inputs:
  evaluation-id:
    description: Stable evaluation identifier.
    required: true
  tool-name:
    description: Scanner name.
    required: true
  tool-version:
    description: Exact scanner version used by the invocation.
    required: true
  tool-outcome:
    description: success, failure, cancelled, timed-out, or skipped.
    required: true
  tool-exit-code:
    description: Raw scanner exit code when available.
    required: false
    default: ""
  raw-evidence:
    description: Raw SARIF file produced by the scanner.
    required: false
    default: ""
  evidence-artifact:
    description: Durable GitHub artifact name containing the raw evidence.
    required: false
    default: ""
  remediation-guidance:
    description: Actionable remediation guidance shown with findings.
    required: false
    default: Review the reported rule, correct the affected source, and document any verified false positive.
  max-summary-findings:
    description: Maximum findings rendered in the job summary and annotations.
    required: false
    default: "20"
  blocking:
    description: Fail when validated evidence contains findings.
    required: false
    default: "false"
  scope-target:
    description: Human-readable evaluated target.
    required: false
    default: repository
  coverage-included:
    description: JSON array describing included scope.
    required: false
    default: "[]"
  coverage-excluded:
    description: JSON array describing excluded scope.
    required: false
    default: "[]"
  coverage-limitations:
    description: JSON array of known limitations.
    required: false
    default: "[]"
  evaluation-result-file:
    description: Destination for normalized Evaluation Result JSON.
    required: false
    default: ""
  summary-file:
    description: Destination for the readable evaluation summary.
    required: false
    default: ""

outputs:
  completion:
    description: complete, incomplete, skipped, or error.
    value: ${{ steps.adapt.outputs.completion }}
  findings-count:
    description: Authoritative count when available.
    value: ${{ steps.adapt.outputs.findings_count }}
  merge-conclusion:
    description: pass, fail, or not-evaluated.
    value: ${{ steps.adapt.outputs.merge_conclusion }}
  evaluation-result:
    description: Path to the v1 Evaluation Result JSON.
    value: ${{ steps.adapt.outputs.evaluation_result }}
  evidence-artifact:
    description: Durable artifact name containing raw evidence.
    value: ${{ steps.adapt.outputs.evidence_artifact }}
  summary:
    description: Path to the readable evaluation summary.
    value: ${{ steps.adapt.outputs.summary }}

runs:
  using: composite
  steps:
    - id: adapt
      shell: bash
      env:
        EVALUATION_ID: ${{ inputs.evaluation-id }}
        TOOL_NAME: ${{ inputs.tool-name }}
        TOOL_VERSION: ${{ inputs.tool-version }}
        TOOL_OUTCOME: ${{ inputs.tool-outcome }}
        TOOL_EXIT_CODE: ${{ inputs.tool-exit-code }}
        RAW_EVIDENCE: ${{ inputs.raw-evidence }}
        EVIDENCE_ARTIFACT: ${{ inputs.evidence-artifact }}
        REMEDIATION_GUIDANCE: ${{ inputs.remediation-guidance }}
        MAX_SUMMARY_FINDINGS: ${{ inputs.max-summary-findings }}
        BLOCKING: ${{ inputs.blocking }}
        SCOPE_TARGET: ${{ inputs.scope-target }}
        COVERAGE_INCLUDED: ${{ inputs.coverage-included }}
        COVERAGE_EXCLUDED: ${{ inputs.coverage-excluded }}
        COVERAGE_LIMITATIONS: ${{ inputs.coverage-limitations }}
        EVALUATION_RESULT_FILE: ${{ inputs.evaluation-result-file }}
        SUMMARY_FILE: ${{ inputs.summary-file }}
        EVALUATION_REPOSITORY: ${{ github.repository }}
        EVALUATION_REF: ${{ github.sha }}
      run: bash "${GITHUB_ACTION_PATH}/evaluation-adapter.sh"