entrypoint.sh

#!/usr/bin/env bash
# Entrypoint for the envaudit GitHub Action.
#
# Reads action inputs via INPUT_* env vars (GitHub Actions' standard
# convention for `docker` actions), runs envaudit, writes a step summary,
# sets action outputs, and exits with envaudit's own exit code so a
# workflow step naturally fails the job on findings.
set -euo pipefail

SCAN_PATH="${INPUT_PATH:-.}"
CONFIG_PATH="${INPUT_CONFIG:-.envaudit.yml}"
STRICT="${INPUT_STRICT:-true}"

# GITHUB_WORKSPACE is where actions/checkout puts the repo; envaudit needs
# to run there (or a subpath of it) to see the user's files and .git dir.
cd "${GITHUB_WORKSPACE:-.}"

STRICT_FLAG="--strict"
if [ "$STRICT" = "false" ]; then
  STRICT_FLAG="--no-strict"
fi

echo "::group::envaudit scan"
set +e
TEXT_OUTPUT=$(envaudit scan "$SCAN_PATH" --config "$CONFIG_PATH" --no-color "$STRICT_FLAG")
TEXT_EXIT=$?
set -e
echo "$TEXT_OUTPUT"
echo "::endgroup::"

# Re-run in JSON mode to build outputs / the step summary. This is cheap —
# scanning is I/O-bound over a handful of small files — and keeps the
# human-readable and machine-readable paths independent, so a parsing bug
# in one never breaks the other.
JSON_OUTPUT=$(envaudit scan "$SCAN_PATH" --config "$CONFIG_PATH" --no-strict --format json || echo '{"findings":[],"files_scanned":0}')

# Count findings. `grep` exits 1 when there are no matches, which would
# trip `set -euo pipefail` and fail the step on a perfectly clean scan —
# the `|| true` keeps the pipeline from aborting when the count is 0.
FINDINGS_COUNT=$(echo "$JSON_OUTPUT" | grep -o '"severity"' | wc -l | tr -d ' ' || true)
HIGHEST_SEVERITY="ok"
for level in low medium high critical; do
  if echo "$JSON_OUTPUT" | grep -q "\"severity\": \"$level\""; then
    HIGHEST_SEVERITY="$level"
  fi
done

if [ -n "${GITHUB_OUTPUT:-}" ]; then
  {
    echo "findings-count=$FINDINGS_COUNT"
    echo "highest-severity=$HIGHEST_SEVERITY"
    echo "exit-code=$TEXT_EXIT"
  } >> "$GITHUB_OUTPUT"
fi

if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
  {
    echo "## envaudit report"
    echo ""
    if [ "$FINDINGS_COUNT" = "0" ]; then
      echo "✅ No issues found."
    else
      echo "**Highest severity:** \`$HIGHEST_SEVERITY\`  "
      echo "**Total findings:** $FINDINGS_COUNT"
      echo ""
      echo '```'
      echo "$TEXT_OUTPUT"
      echo '```'
    fi
  } >> "$GITHUB_STEP_SUMMARY"
fi

exit "$TEXT_EXIT"