action.yml

name: Code Audit

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: [main, master]

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # needed for --since-commit

      - name: Run code-auditor
        id: audit
        uses: docker://ghcr.io/your-org/code-auditor:latest
        with:
          args: >
            scan ${{ github.workspace }}
            --format json
            --output /github/workspace/audit-report.json
            --fail-on high

      - name: Upload HTML report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: audit-report
          path: audit-report.json

      - name: Comment on PR
        if: github.event_name == 'pull_request' && always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
          REPORT_PATH: audit-report.json
        run: |
          pip install httpx
          python integrations/github/pr_commenter.py