action.yml

name: 'AI Surface Check'
description: 'Map AI attack surfaces in pull requests and gate new high-risk findings before merge.'
author: 'APIsec'
branding:
  icon: 'eye'
  color: 'blue'

inputs:
  path:
    description: 'Directory to scan, relative to the repository root.'
    required: false
    default: '.'
  comment-on-pr:
    description: 'Post (or update) a PR comment with the AI surface report. Set to "false" to disable.'
    required: false
    default: 'true'
  fail-on-risk:
    description: 'Exit non-zero if any risk indicators are detected. Aggressive; prefer fail-on for a severity threshold.'
    required: false
    default: 'false'
  fail-on:
    description: 'Severity-threshold gate: fail the build if a finding is at or above this severity (critical|high|medium|low). On PRs with a base ref, gates only on NEWLY introduced findings. Recommended: high.'
    required: false
    default: ''
  write-inventory:
    description: 'Write .ai-inventory.md back to the workspace.'
    required: false
    default: 'false'
  github-token:
    description: 'Token used to post PR comments. Defaults to the workflow GITHUB_TOKEN.'
    required: false
    default: ${{ github.token }}

outputs:
  surfaces-count:
    description: 'Number of production AI surfaces detected.'
  risk-count:
    description: 'Number of risk indicators detected.'
  json-report:
    description: 'Path to the JSON report file (inside the runner workspace).'

runs:
  using: 'docker'
  image: 'Dockerfile'
  env:
    AI_SURFACE_INPUT_PATH: ${{ inputs.path }}
    AI_SURFACE_COMMENT_ON_PR: ${{ inputs.comment-on-pr }}
    AI_SURFACE_FAIL_ON_RISK: ${{ inputs.fail-on-risk }}
    AI_SURFACE_FAIL_ON: ${{ inputs.fail-on }}
    AI_SURFACE_WRITE_INVENTORY: ${{ inputs.write-inventory }}
    AI_SURFACE_GITHUB_TOKEN: ${{ inputs.github-token }}