action.yml

name: 'Fluid Attacks SAST'
description: 'Run static application security testing with Fluid Attacks scanner'
author: 'Fluid Attacks'

branding:
  icon: 'shield'
  color: 'red'

inputs:
  scan_config_path:
    description: >
      Path to the YAML configuration file, relative to the repository root.
      When not provided, the action runs with built-in defaults.
      The job fails if the file does not exist at the given path.
    required: false
    default: ''
  scanner_mode:
    description: >
      Override the scan mode. Use "diff" to always run a differential scan
      (changed files only) or "full" to always scan the entire repository.
      If omitted, the mode is determined automatically: full scan on pushes
      to the default branch, differential scan on pushes to other branches
      and on pull requests.
    required: false
    default: ''

outputs:
  sarif_file:
    description: 'Path to SARIF results file (if SARIF format selected)'
    value: ${{ steps.scan.outputs.sarif_file }}
  vulnerabilities_found:
    description: 'Whether vulnerabilities were found (true/false)'
    value: ${{ steps.scan.outputs.vulnerabilities_found }}

runs:
  using: 'composite'
  steps:
    - name: Resolve config and mode
      id: resolve
      shell: bash
      run: bash "${{ github.action_path }}/resolve-mode.sh"
      env:
        SCAN_CONFIG_PATH: ${{ inputs.scan_config_path }}
        SCANNER_MODE: ${{ inputs.scanner_mode }}
        PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}

    - name: Get changed files
      if: steps.resolve.outputs.mode == 'diff'
      id: changed
      uses: tj-actions/changed-files@v46
      with:
        base_sha: ${{ steps.resolve.outputs.base_sha }}
        separator: ' '

    - name: Run scan
      id: scan
      shell: bash
      run: |
        echo "Current branch: ${{ github.head_ref || github.ref_name }}"
        bash "${{ github.action_path }}/generate-config.sh"
      env:
        INPUT_MODE: ${{ steps.resolve.outputs.mode }}
        CHANGED_FILES: ${{ steps.changed.outputs.all_changed_files }}
        GITHUB_REPOSITORY: ${{ github.repository }}
        USER_CONFIG_FILE: ${{ steps.resolve.outputs.config_file }}