action.yml

name: "EEG - AI Security Scanner"
description: "Static AI/agent security scan via the EEG CLI (SARIF/JSON). Same entry point as local eeg / python -m eeg."
author: "findthehead"

branding:
  icon: "shield"
  color: "blue"

inputs:
  path:
    description: "Repository path to scan"
    required: false
    default: "."
  profile:
    description: "Scan profile (code, agent, full, model, dep)"
    required: false
    default: "code"
  format:
    description: "Output format (json or sarif)"
    required: false
    default: "sarif"
  output:
    description: "Report file path"
    required: false
    default: "eeg-results.sarif"
  fail-on:
    description: "Fail when findings meet this severity (none, low, medium, high, critical, any)"
    required: false
    default: "high"
  cloud:
    description: "Optional cloud hint for full profile (aws, azure, gcp, any)"
    required: false
    default: ""
  version:
    description: "Pin eeg-security version (empty = latest from PyPI)"
    required: false
    default: ""
  extra-args:
    description: "Additional CLI arguments appended to the scan command"
    required: false
    default: ""

outputs:
  findings-count:
    description: "Total findings (best-effort from JSON summary when format=json)"
    value: ${{ steps.scan.outputs.findings-count }}
  critical-count:
    description: "CRITICAL findings count when format=json"
    value: ${{ steps.scan.outputs.critical-count }}
  high-count:
    description: "HIGH findings count when format=json"
    value: ${{ steps.scan.outputs.high-count }}
  report-file:
    description: "Path to the generated report"
    value: ${{ steps.scan.outputs.report-file }}
  exit-code:
    description: "CLI exit code"
    value: ${{ steps.scan.outputs.exit-code }}

runs:
  using: "composite"
  steps:
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.12"

    - name: Install EEG
      shell: bash
      run: |
        python -m pip install --upgrade pip
        if [ -n "${{ inputs.version }}" ]; then
          pip install "eeg-security==${{ inputs.version }}"
        else
          pip install eeg-security
        fi

    - name: Run EEG scan
      id: scan
      shell: bash
      run: |
        set +e
        EXTRA=()
        if [ -n "${{ inputs.cloud }}" ]; then
          EXTRA+=(--cloud "${{ inputs.cloud }}")
        fi
        # shellcheck disable=SC2086
        python -m eeg scan "${{ inputs.path }}" \
          --profile "${{ inputs.profile }}" \
          --format "${{ inputs.format }}" \
          --output "${{ inputs.output }}" \
          --fail-on "${{ inputs.fail-on }}" \
          "${EXTRA[@]}" \
          ${{ inputs.extra-args }}
        CODE=$?
        echo "exit-code=$CODE" >> "$GITHUB_OUTPUT"
        echo "report-file=${{ inputs.output }}" >> "$GITHUB_OUTPUT"

        TOTAL="0"
        CRITICAL="0"
        HIGH="0"
        if [ "${{ inputs.format }}" = "json" ] && [ -f "${{ inputs.output }}" ]; then
          TOTAL=$(jq -r '.summary.total_findings // 0' "${{ inputs.output }}" 2>/dev/null || echo "0")
          CRITICAL=$(jq -r '.summary.by_severity.CRITICAL // 0' "${{ inputs.output }}" 2>/dev/null || echo "0")
          HIGH=$(jq -r '.summary.by_severity.HIGH // 0' "${{ inputs.output }}" 2>/dev/null || echo "0")
        fi
        echo "findings-count=$TOTAL" >> "$GITHUB_OUTPUT"
        echo "critical-count=$CRITICAL" >> "$GITHUB_OUTPUT"
        echo "high-count=$HIGH" >> "$GITHUB_OUTPUT"
        echo "::notice::EEG scan finished (exit=$CODE, findings≈$TOTAL)"
        exit "$CODE"