action.yml

name: 'CodeAnt CI Scan'
description: 'Run CodeAnt CI security and code quality analysis on your repository'
author: 'CodeAnt'
branding:
  icon: 'shield'
  color: 'blue'

inputs:
  access_token:
    description: 'CodeAnt access token (PAT or repository token)'
    required: true
  api_base:
    description: 'CodeAnt API base URL'
    required: false
    default: 'https://api.codeant.ai'
  include_paths:
    description: 'Comma-separated paths to include in scan'
    required: false
    default: ''
  exclude_paths:
    description: 'Comma-separated paths to exclude from scan'
    required: false
    default: ''
  scan_timeout:
    description: 'Scan timeout in seconds'
    required: false
    default: '300'
  scanners:
    description: 'Security scanners to run (sast, sca, secrets, antipatterns, iac, all)'
    required: false
    default: 'sast,sca'

runs:
  using: 'composite'
  steps:
    - name: Fetch CodeAnt scan script
      shell: bash
      env:
        API_BASE: ${{ inputs.api_base }}
      run: |
        curl -sS -X GET "${API_BASE}/analysis/ci/scan/script/get" \
          --output start_scan.sh.b64

    - name: Make script executable
      shell: bash
      env:
        API_BASE: ${{ inputs.api_base }}
      run: |
        if [ "$API_BASE" = "https://api.codeant.ai" ]; then
          base64 -d start_scan.sh.b64 > start_scan.sh
        else
          mv start_scan.sh.b64 start_scan.sh
        fi
        chmod +x start_scan.sh

    - name: Trigger CodeAnt analysis
      shell: bash
      env:
        ACCESS_TOKEN: ${{ inputs.access_token }}
        REPO_NAME: ${{ github.repository }}
        COMMIT_ID: ${{ github.event.pull_request.head.sha || github.sha }}
        BRANCH: ${{ github.ref_name }}
        INCLUDE_PATHS: ${{ inputs.include_paths }}
        EXCLUDE_PATHS: ${{ inputs.exclude_paths }}
        SCAN_TIMEOUT: ${{ inputs.scan_timeout }}
        SCANNERS: ${{ inputs.scanners }}
      run: |
        bash start_scan.sh \
          -a "$ACCESS_TOKEN" \
          -r "$REPO_NAME" \
          -c "$COMMIT_ID" \
          -b "$BRANCH" \
          -s github \
          -i "$INCLUDE_PATHS" \
          -e "$EXCLUDE_PATHS" \
          -t "$SCAN_TIMEOUT" \
          --scanners "$SCANNERS"