action.yml

name: "Scantrix Audit"
description: "Run Scantrix static analysis on your test automation repo and get a quality report"
author: "Scantrix"

branding:
  icon: "shield"
  color: "blue"

inputs:
  repo-path:
    description: "Path to the repository to scan (defaults to workspace root)"
    required: false
    default: "."
  output-dir:
    description: "Directory to write audit artifacts"
    required: false
    default: "./scantrix-out"
  config-path:
    description: "Path to .auditrc.json config file"
    required: false
  format:
    description: "Output formats (comma-separated: md,html,json,sarif,email)"
    required: false
    default: "md,html,json,sarif"
  check-updates:
    description: "Check npm registry for outdated dependencies"
    required: false
    default: "false"
  post-comment:
    description: "Post a summary comment on the PR (true/false)"
    required: false
    default: "true"
  fail-on-high:
    description: "Fail the action if high-severity findings are detected"
    required: false
    default: "false"

outputs:
  findings-count:
    description: "Total number of findings detected"
  high-count:
    description: "Number of high-severity findings"
  medium-count:
    description: "Number of medium-severity findings"
  low-count:
    description: "Number of low-severity findings"
  risk-grade:
    description: "Overall risk grade (A-F)"
  report-path:
    description: "Path to the generated report directory"

runs:
  using: "composite"
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: "20"

    - name: Install Scantrix
      shell: bash
      run: npm install -g @scantrix/cli

    - name: Run Audit
      id: audit
      shell: bash
      run: |
        RESULTS_PATH="${{ inputs.output-dir }}/scantrix-results.json"
        ARGS="${{ inputs.repo-path }} --out ${{ inputs.output-dir }} --format ${{ inputs.format }} --json-path $RESULTS_PATH"

        if [ "${{ inputs.config-path }}" != "" ]; then
          ARGS="$ARGS --config ${{ inputs.config-path }}"
        fi

        if [ "${{ inputs.check-updates }}" = "true" ]; then
          ARGS="$ARGS --updates"
        fi

        echo "[scantrix] Running: scantrix $ARGS"
        npx @scantrix/cli $ARGS

        # Parse outputs from canonical ScanResult JSON
        if [ -f "$RESULTS_PATH" ]; then
          TOTAL=$(jq '.summary.total' "$RESULTS_PATH")
          HIGH=$(jq '.summary.high' "$RESULTS_PATH")
          MEDIUM=$(jq '.summary.medium' "$RESULTS_PATH")
          LOW=$(jq '.summary.low' "$RESULTS_PATH")
          GRADE=$(jq -r '.summary.riskGrade' "$RESULTS_PATH")

          echo "findings-count=$TOTAL" >> $GITHUB_OUTPUT
          echo "high-count=$HIGH" >> $GITHUB_OUTPUT
          echo "medium-count=$MEDIUM" >> $GITHUB_OUTPUT
          echo "low-count=$LOW" >> $GITHUB_OUTPUT
          echo "risk-grade=$GRADE" >> $GITHUB_OUTPUT
          echo "report-path=${{ inputs.output-dir }}" >> $GITHUB_OUTPUT
        fi

    - name: Upload Report Artifacts
      uses: actions/upload-artifact@v4
      with:
        name: scantrix-report
        path: ${{ inputs.output-dir }}
        retention-days: 30

    - name: Post PR Comment
      if: inputs.post-comment == 'true' && github.event_name == 'pull_request'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const path = require('path');

          const outDir = '${{ inputs.output-dir }}';
          const findingsFile = path.join(outDir, 'findings.json');
          const diffFile = path.join(outDir, 'audit_diff.json');

          const resultsFile = path.join(outDir, 'scantrix-results.json');
          if (!fs.existsSync(findingsFile) || !fs.existsSync(resultsFile)) {
            console.log('No findings.json or scantrix-results.json found, skipping comment');
            return;
          }

          const findings = JSON.parse(fs.readFileSync(findingsFile, 'utf8'));
          const high = findings.filter(f => f.severity === 'high').length;
          const medium = findings.filter(f => f.severity === 'medium').length;
          const low = findings.filter(f => f.severity === 'low').length;
          const total = findings.length;

          // Read grade from canonical ScanResult (computed by scoring.ts)
          const results = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));
          const grade = results.summary.riskGrade;
          const gradeEmoji = { A: '🟢', B: '🔵', C: '🟡', D: '🟠', F: '🔴' }[grade] || '⚪';

          let body = `## ${gradeEmoji} Scantrix Audit Report\n\n`;
          body += `| Metric | Value |\n|--------|-------|\n`;
          body += `| **Grade** | **${grade}** |\n`;
          body += `| Total Findings | ${total} |\n`;
          body += `| 🔴 High | ${high} |\n`;
          body += `| 🟠 Medium | ${medium} |\n`;
          body += `| 🟡 Low | ${low} |\n\n`;

          // Diff section if available
          if (fs.existsSync(diffFile)) {
            try {
              const diff = JSON.parse(fs.readFileSync(diffFile, 'utf8'));
              if (diff.newFindings?.length > 0 || diff.resolvedFindings?.length > 0) {
                body += `### Diff Delta\n\n`;
                if (diff.newFindings.length > 0) {
                  body += `**🆕 ${diff.newFindings.length} new issue${diff.newFindings.length > 1 ? 's' : ''}:**\n`;
                  for (const f of diff.newFindings.slice(0, 5)) {
                    const sev = f.severity === 'high' ? '🔴' : f.severity === 'medium' ? '🟠' : '🟡';
                    body += `- ${sev} \`${f.findingId}\`: ${f.title}\n`;
                  }
                  if (diff.newFindings.length > 5) body += `- ... and ${diff.newFindings.length - 5} more\n`;
                  body += `\n`;
                }
                if (diff.resolvedFindings.length > 0) {
                  body += `**✅ ${diff.resolvedFindings.length} resolved:**\n`;
                  for (const f of diff.resolvedFindings.slice(0, 5)) {
                    body += `- ~~\`${f.findingId}\`: ${f.title}~~\n`;
                  }
                  if (diff.resolvedFindings.length > 5) body += `- ... and ${diff.resolvedFindings.length - 5} more\n`;
                  body += `\n`;
                }
              }
            } catch (e) {
              console.log('Could not parse diff file:', e);
            }
          }

          // Top findings
          if (findings.length > 0) {
            body += `<details>\n<summary>Top Findings</summary>\n\n`;
            body += `| ID | Title | Severity |\n|----|-------|----------|\n`;
            for (const f of findings.slice(0, 10)) {
              const sev = f.severity === 'high' ? '🔴 High' : f.severity === 'medium' ? '🟠 Medium' : '🟡 Low';
              body += `| \`${f.findingId}\` | ${f.title} | ${sev} |\n`;
            }
            if (findings.length > 10) body += `\n*... and ${findings.length - 10} more findings*\n`;
            body += `\n</details>\n`;
          }

          body += `\n---\n*Generated by [Scantrix](https://github.com/scantrix/scantrix) — Test Automation Intelligence*`;

          // Find existing comment to update (avoid spamming)
          const { data: comments } = await github.rest.issues.listComments({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
          });
          const existingComment = comments.find(c => c.body && c.body.includes('Scantrix Audit Report'));

          if (existingComment) {
            await github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: existingComment.id,
              body,
            });
          } else {
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            });
          }

    - name: Fail on High Severity
      if: inputs.fail-on-high == 'true'
      shell: bash
      run: |
        HIGH=${{ steps.audit.outputs.high-count }}
        if [ "$HIGH" != "0" ] && [ "$HIGH" != "" ]; then
          echo "::error::Scantrix found $HIGH high-severity findings. Failing build."
          exit 1
        fi