action.yml

name: "AgentShield Security Gate"
description: "Zero-Leak Secret Defense & Sandbox for Pull Requests and Autonomous AI Agents"
author: "RitualDev Lab"

inputs:
  base_ref:
    description: "Target base git branch to compare diff against (default: origin/main)"
    required: false
    default: "origin/main"
  fail_on_leak:
    description: "Whether to fail the CI step if secrets are detected"
    required: false
    default: "true"
  github_token:
    description: "GitHub secret token used to post inline annotations and sticky PR comments (defaults to github.token)"
    required: false
    default: ""
  post_pr_comment:
    description: "Whether to post or update a sticky security audit comment on Pull Requests"
    required: false
    default: "true"
  annotate_diff:
    description: "Whether to emit GitHub Actions inline workflow command annotations (::error)"
    required: false
    default: "true"
  sarif_file:
    description: "Path to export OASIS SARIF 2.1.0 report (for GitHub Code Scanning upload-sarif)"
    required: false
    default: ".agentshield.sarif"

runs:
  using: "composite"
  steps:
    - name: Run AgentShield CI Security Audit & PR Bot
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github_token || github.token }}
        INPUT_BASE_REF: ${{ inputs.base_ref }}
        INPUT_FAIL_ON_LEAK: ${{ inputs.fail_on_leak }}
        INPUT_POST_PR_COMMENT: ${{ inputs.post_pr_comment }}
        INPUT_ANNOTATE_DIFF: ${{ inputs.annotate_diff }}
        INPUT_SARIF_FILE: ${{ inputs.sarif_file }}
        ACTION_PATH: ${{ github.action_path }}
      run: |
        EXTRA_FLAGS=""
        if [ "$INPUT_ANNOTATE_DIFF" = "true" ]; then
          EXTRA_FLAGS="$EXTRA_FLAGS --annotate"
        fi
        if [ "$INPUT_POST_PR_COMMENT" = "true" ]; then
          EXTRA_FLAGS="$EXTRA_FLAGS --post-pr-comment"
        fi
        if [ -n "$INPUT_SARIF_FILE" ]; then
          EXTRA_FLAGS="$EXTRA_FLAGS --sarif $INPUT_SARIF_FILE"
        fi

        EXIT_CODE=0
        if [ -f "$ACTION_PATH/dist/cli.js" ]; then
          node "$ACTION_PATH/dist/cli.js" ci --base "$INPUT_BASE_REF" --report .agentshield-report.md $EXTRA_FLAGS || EXIT_CODE=$?
        elif [ -f "$ACTION_PATH/package.json" ]; then
          (cd "$ACTION_PATH" && npm install --silent && npm run build --silent)
          node "$ACTION_PATH/dist/cli.js" ci --base "$INPUT_BASE_REF" --report .agentshield-report.md $EXTRA_FLAGS || EXIT_CODE=$?
        else
          npx --yes @ritualdev-lab/agentshield@latest ci --base "$INPUT_BASE_REF" --report .agentshield-report.md $EXTRA_FLAGS || EXIT_CODE=$?
        fi

        if [ -f .agentshield-report.md ]; then
          cat .agentshield-report.md >> "$GITHUB_STEP_SUMMARY"
        fi

        if [ "$INPUT_FAIL_ON_LEAK" = "true" ] && [ $EXIT_CODE -ne 0 ]; then
          echo "❌ [AgentShield] Exposed secrets detected in Pull Request diff. Merging blocked."
          exit $EXIT_CODE
        fi

branding:
  icon: "shield"
  color: "purple"