action.yml

name: Upstream Radar
description: Check a reviewed DSH dependency graph for active upstream vulnerabilities.
author: MicroMilo
branding:
  icon: shield
  color: blue

outputs:
  probe-result:
    description: 'Optional DSH load-matrix result: compatible, incompatible, or unknown.'
    value: ${{ steps.dsh-load-matrix.outputs.result }}

inputs:
  config:
    description: Reviewed Upstream Radar config path, relative to the working directory.
    required: false
    default: upstream-radar.config.json
  fail-on:
    description: Minimum active vulnerability severity that fails the job.
    required: false
    default: high
  fail-on-compatibility:
    description: 'Compatibility changes that fail the job: never, breaking, or any.'
    required: false
    default: never
  state:
    description: 'Radar state path; use :memory: for an independent CI check.'
    required: false
    default: ':memory:'
  version:
    description: Exact upstream-radar npm version to execute.
    required: false
    default: 0.32.0
  node-version:
    description: Node.js version used to run the CLI.
    required: false
    default: '22'
  working-directory:
    description: Directory containing the reviewed config and project checkout.
    required: false
    default: .
  probe-package:
    description: 'Optional exact npm package spec (name@version) to pack and probe across DSH versions.'
    required: false
    default: ''
  probe-dsh-versions:
    description: 'Comma-separated exact DSH versions for the optional load matrix; use at least two.'
    required: false
    default: ''
  probe-timeout:
    description: 'Per-version timeout in seconds for the optional DSH load matrix (30-600).'
    required: false
    default: '120'

runs:
  using: composite
  steps:
    - name: Set up pnpm
      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      with:
        version: 11.3.0
        run_install: false
    - name: Set up Node.js
      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      with:
        node-version: ${{ inputs.node-version }}
    - name: Check reviewed DSH graph
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        RADAR_CONFIG: ${{ inputs.config }}
        RADAR_FAIL_ON: ${{ inputs.fail-on }}
        RADAR_FAIL_ON_COMPATIBILITY: ${{ inputs.fail-on-compatibility }}
        RADAR_STATE: ${{ inputs.state }}
        RADAR_VERSION: ${{ inputs.version }}
      run: >-
        pnpm dlx --package="upstream-radar@$RADAR_VERSION" upstream-radar
        radar check "$RADAR_CONFIG"
        --frozen
        --state "$RADAR_STATE"
        --fail-on "$RADAR_FAIL_ON"
        --fail-on-compatibility "$RADAR_FAIL_ON_COMPATIBILITY"
        --json
    - name: Probe published plugin across DSH versions
      if: inputs.probe-package != ''
      id: dsh-load-matrix
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        RADAR_VERSION: ${{ inputs.version }}
        RADAR_PROBE_PACKAGE: ${{ inputs.probe-package }}
        RADAR_PROBE_DSH_VERSIONS: ${{ inputs.probe-dsh-versions }}
        RADAR_PROBE_TIMEOUT: ${{ inputs.probe-timeout }}
      run: |
        set -euo pipefail
        exact_package='^(@[^/@[:space:]]+/[^@/[:space:]]+|[^@/[:space:]]+)@[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'
        if [[ ! "$RADAR_PROBE_PACKAGE" =~ $exact_package ]]; then
          echo 'probe-package must be an exact npm package spec such as dsh-cloudflare-browser-run@0.1.1' >&2
          exit 1
        fi
        if [[ -z "$RADAR_PROBE_DSH_VERSIONS" ]]; then
          echo 'probe-dsh-versions is required when probe-package is set' >&2
          exit 1
        fi
        probe_dir="$RUNNER_TEMP/upstream-radar-dsh-probe"
        mkdir -p "$probe_dir"
        npm pack --ignore-scripts --pack-destination "$probe_dir" "$RADAR_PROBE_PACKAGE" >/dev/null
        shopt -s nullglob
        probe_tarballs=("$probe_dir"/*.tgz)
        if (( ${#probe_tarballs[@]} != 1 )); then
          echo "expected exactly one npm tarball, found ${#probe_tarballs[@]}" >&2
          exit 1
        fi
        report_file="$probe_dir/report.json"
        set +e
        pnpm dlx --package="upstream-radar@$RADAR_VERSION" upstream-radar \
          probe dsh-matrix "${probe_tarballs[0]}" \
          --dsh-version "$RADAR_PROBE_DSH_VERSIONS" \
          --timeout "$RADAR_PROBE_TIMEOUT" \
          --json | tee "$report_file"
        probe_exit=${PIPESTATUS[0]}
        set -e
        probe_result="$(REPORT_FILE="$report_file" node --input-type=module -e 'import { readFileSync } from "node:fs"; const report = JSON.parse(readFileSync(process.env.REPORT_FILE, "utf8")); process.stdout.write(report.result)' 2>/dev/null || printf 'unknown')"
        printf 'result=%s\n' "$probe_result" >> "$GITHUB_OUTPUT"
        exit "$probe_exit"