SessionScope/action.yml at main · bjcorder/SessionScope · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: SessionScope
description: Run SessionScope in GitHub Actions and publish advisory scan reports.

inputs:
  mode:
    description: Policy mode. Use advisory to report only or enforce to fail on matching findings.
    required: false
    default: advisory
  path:
    description: |
      Repository-relative path to scan. Must not be absolute and must not
      contain '..' segments. The action rejects traversal syntactically before
      invoking SessionScope; the scanner also refuses symlinked source entries.
    required: false
    default: .
  output:
    description: "Comma-separated report formats to produce: markdown, json, sarif."
    required: false
    default: markdown,sarif
  fail-on-findings:
    description: Backward-compatible shortcut for mode=enforce with fail-severity=info.
    required: false
    default: "false"
  fail-severity:
    description: "Minimum severity that fails enforce mode: high, medium, low, or info."
    required: false
    default: high
  fail-category:
    description: Comma-separated finding categories that fail enforce mode. Empty means all categories.
    required: false
    default: ""
  include-finding-id:
    description: Comma-separated finding IDs that always fail unless excluded.
    required: false
    default: ""
  exclude-finding-id:
    description: Comma-separated finding IDs that never fail.
    required: false
    default: ""
  baseline:
    description: Path to a prior SessionScope JSON report whose finding IDs are suppressed.
    required: false
    default: ""

outputs:
  reports-dir:
    description: Directory containing generated SessionScope reports.
    value: ${{ steps.sessionscope.outputs.reports-dir }}
  markdown-path:
    description: Path to the generated Markdown report, when requested.
    value: ${{ steps.sessionscope.outputs.markdown-path }}
  json-path:
    description: Path to the generated JSON report, when requested.
    value: ${{ steps.sessionscope.outputs.json-path }}
  sarif-path:
    description: Path to the generated SARIF report, when requested.
    value: ${{ steps.sessionscope.outputs.sarif-path }}
  summary-path:
    description: Path to the generated GitHub summary Markdown.
    value: ${{ steps.sessionscope.outputs.summary-path }}

runs:
  using: composite
  steps:
    - id: sessionscope
      shell: bash
      env:
        GITHUB_ACTION_REF: ${{ github.action_ref }}
        GITHUB_ACTION_REPOSITORY: ${{ github.action_repository }}
        INPUT_MODE: ${{ inputs.mode }}
        INPUT_PATH: ${{ inputs.path }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_FAIL_ON_FINDINGS: ${{ inputs.fail-on-findings }}
        INPUT_FAIL_SEVERITY: ${{ inputs.fail-severity }}
        INPUT_FAIL_CATEGORY: ${{ inputs.fail-category }}
        INPUT_INCLUDE_FINDING_ID: ${{ inputs.include-finding-id }}
        INPUT_EXCLUDE_FINDING_ID: ${{ inputs.exclude-finding-id }}
        INPUT_BASELINE: ${{ inputs.baseline }}
      run: bash "$GITHUB_ACTION_PATH/scripts/github-action.sh"