action.yml

name: "SecScore"
description: "Security scoring engine for CI/CD pipelines. Convert SARIF findings into a single score and security decision."
author: "Cássio B. Pereira a.k.a. @cassiodeveloper"

branding:
  icon: "shield"
  color: "gray-dark"

inputs:
  findings:
    description: "Path to findings.json (generated by your scanners/normalizers)"
    required: false
  policy:
    description: "Path to SecScore policy YAML"
    required: false
    default: policy/policy-default.yml
  sarif:
    description: >
      Path to one or more SARIF files. Accepts a single path or a comma-separated list of paths. Example: "semgrep.sarif,trivy.sarif"
    required: false
  no_diff_aware:
    description: "Set to 'true' to disable diff-aware filtering (enabled by default)"
    required: false
    default: "false"
  base_ref:
    description: "Git ref to diff against for diff-aware filtering (default: origin/main)"
    required: false
    default: "origin/main"
  max_findings:
    description: "Max findings to show in PR comment"
    required: false
    default: "5"
  label_review:
    description: "Label to apply when decision is REVIEW"
    required: false
    default: "secscore-review"
  check_name:
    description: "Name of the GitHub Check Run"
    required: false
    default: "SecScore"
  provider:
    description: "Provider name for context (e.g. 'checkmarx', 'snyk')"
    required: false
  checkmarx-project:
    description: "Checkmarx project name for context"
    required: false
  checkmarx-base-url:
    description: "Checkmarx base URL for context"
    required: false
  checkmarx-token:
    description: "Checkmarx token for context"
    required: false
  branch:
    description: "Branch name for context"
    required: false

outputs:
  decision:
    description: "PASS | REVIEW | FAIL"
    value: ${{ steps.read_result.outputs.decision }}
  score:
    description: "0-100 score"
    value: ${{ steps.read_result.outputs.score }}
  exit_code:
    description: "0=PASS, 1=REVIEW, 2=FAIL"
    value: ${{ steps.secscore.outputs.exit_code }}

runs:
  using: "composite"
  steps:
  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: "3.11"

  - name: Install SecScore (from this action repo)
    shell: bash
    run: |
      python -m pip install --upgrade pip
      pip install -r "${GITHUB_ACTION_PATH}/requirements.txt"
      pip install -e "${GITHUB_ACTION_PATH}"

  - name: Run SecScore
    id: secscore
    shell: bash
    run: |
      POLICY_PATH="${{ inputs.policy }}"
      if [ -z "$POLICY_PATH" ]; then
        POLICY_PATH="${GITHUB_ACTION_PATH}/policy/policy-default.yml"
        echo "Using default policy from action"
      else
        echo "Using custom policy: $POLICY_PATH"
      fi

      # Monta argumento --sarif (pode ser lista separada por vírgula)
      SARIF_ARG=""
      if [ -n "${{ inputs.sarif }}" ]; then
        SARIF_ARG="--sarif ${{ inputs.sarif }}"
      fi

      # Diff-aware opt-out
      DIFF_ARG=""
      if [ "${{ inputs.no_diff_aware }}" = "true" ]; then
        DIFF_ARG="--no-diff-aware"
      fi

      # Base ref
      BASE_REF_ARG=""
      if [ -n "${{ inputs.base_ref }}" ]; then
        BASE_REF_ARG="--base-ref ${{ inputs.base_ref }}"
      fi

      set +e
      python3 -m secscore.cli.main pr \
        ${SARIF_ARG} \
        --policy "$POLICY_PATH" \
        --out pr-comment.md \
        --json-out secscore-result.json \
        ${DIFF_ARG} \
        ${BASE_REF_ARG}

      code=$?
      echo "exit_code=$code" >> $GITHUB_OUTPUT
      exit 0

  - name: Read SecScore result
    id: read_result
    shell: bash
    run: |
      python3 - << 'PY'
      import json, os, sys
      path = "secscore-result.json"
      if not os.path.exists(path):
          print("decision=FAIL")
          print("score=0")
          sys.exit(0)
      data = json.load(open(path, "r", encoding="utf-8"))
      print(f"decision={data.get('decision','FAIL')}")
      print(f"score={data.get('score',0)}")
      PY >> "$GITHUB_OUTPUT"

  - name: Label PR based on SecScore
    if: ${{ always() }}
    uses: actions/github-script@v7
    with:
      script: |
        const fs = require('fs');
        const label = '${{ inputs.label_review }}';

        if (!fs.existsSync('secscore-result.json')) return;

        const result = JSON.parse(fs.readFileSync('secscore-result.json', 'utf8'));
        const issue  = await github.rest.issues.get({
          owner: context.repo.owner,
          repo:  context.repo.repo,
          issue_number: context.issue.number
        });

        const hasLabel = issue.data.labels.some(l => l.name === label);

        if (result.decision === 'REVIEW' && !hasLabel) {
          await github.rest.issues.addLabels({
            owner: context.repo.owner,
            repo:  context.repo.repo,
            issue_number: context.issue.number,
            labels: [label]
          });
        }

        if (result.decision !== 'REVIEW' && hasLabel) {
          await github.rest.issues.removeLabel({
            owner: context.repo.owner,
            repo:  context.repo.repo,
            issue_number: context.issue.number,
            name: label
          });
        }

  - name: Create SecScore status check
    if: ${{ always() }}
    uses: actions/github-script@v7
    with:
      script: |
        const fs = require('fs');
        const checkName = '${{ inputs.check_name }}';

        if (!fs.existsSync('secscore-result.json')) {
          await github.rest.checks.create({
            owner:    context.repo.owner,
            repo:     context.repo.repo,
            name:     checkName,
            head_sha: context.payload.pull_request.head.sha,
            status:   'completed',
            conclusion: 'failure',
            output: {
              title:   `${checkName} FAIL`,
              summary: 'SecScore did not produce secscore-result.json'
            }
          });
          return;
        }

        const result  = JSON.parse(fs.readFileSync('secscore-result.json', 'utf8'));
        const summary = fs.existsSync('pr-comment.md')
          ? fs.readFileSync('pr-comment.md', 'utf8')
          : `${checkName} ${result.decision} — Score ${result.score}/100`;

        const conclusion =
          result.decision === 'PASS'   ? 'success' :
          result.decision === 'REVIEW' ? 'success' :
          'failure';

        await github.rest.checks.create({
          owner:    context.repo.owner,
          repo:     context.repo.repo,
          name:     checkName,
          head_sha: context.payload.pull_request.head.sha,
          status:   'completed',
          conclusion,
          output: {
            title:   `${checkName} ${result.decision}`,
            summary
          }
        });

  - name: Publish PR comment (upsert)
    if: ${{ always() }}
    uses: actions/github-script@v7
    with:
      script: |
        const fs = require('fs');
        if (!fs.existsSync('pr-comment.md')) return;

        const body     = fs.readFileSync('pr-comment.md', 'utf8');
        const comments = await github.rest.issues.listComments({
          owner: context.repo.owner,
          repo:  context.repo.repo,
          issue_number: context.issue.number
        });

        const marker   = '<!-- SECSCORE_COMMENT -->';
        const existing = comments.data.find(c => (c.body || '').includes(marker));

        if (existing) {
          await github.rest.issues.updateComment({
            owner:      context.repo.owner,
            repo:       context.repo.repo,
            comment_id: existing.id,
            body
          });
        } else {
          await github.rest.issues.createComment({
            owner: context.repo.owner,
            repo:  context.repo.repo,
            issue_number: context.issue.number,
            body
          });
        }

  - name: Fail job on SecScore FAIL
    if: ${{ steps.secscore.outputs.exit_code == '2' }}
    shell: bash
    run: exit 1