Problem
PR outcomes currently come from surface-specific controls: the Action exposes severity and fail-on-findings, the App hard-codes a high/critical failure conclusion, and the CLI has its own --github-pr path. The effective decision policy is neither one contract nor visible to users, so behavior can drift.
Scope
Define a versioned PR-security-policy contract with PR scope, reporting threshold, and blocking threshold. Implement one resolver/evaluator used by the CLI PR path, Action adapter, and GitHub App check-run path. Surface-specific inputs may map into the contract, but identical policy plus identical findings must produce the same included findings and pass/neutral/fail decision.
Non-goals
Do not change scanner rules, finding schema, or GitHub review transport.
Acceptance criteria
- A validated, documented v1 policy schema has explicit defaults and a stable version identifier.
- CLI, Action, and App use the same evaluator rather than independently branching on severity.
- Each surface exposes the effective policy version and values in its machine-readable or PR-facing result.
- A shared fixture proves identical findings plus identical policy yield identical scope, reporting set, and decision across all three surfaces.
Problem
PR outcomes currently come from surface-specific controls: the Action exposes
severityandfail-on-findings, the App hard-codes a high/critical failure conclusion, and the CLI has its own--github-prpath. The effective decision policy is neither one contract nor visible to users, so behavior can drift.Scope
Define a versioned PR-security-policy contract with PR scope, reporting threshold, and blocking threshold. Implement one resolver/evaluator used by the CLI PR path, Action adapter, and GitHub App check-run path. Surface-specific inputs may map into the contract, but identical policy plus identical findings must produce the same included findings and pass/neutral/fail decision.
Non-goals
Do not change scanner rules, finding schema, or GitHub review transport.
Acceptance criteria