feat: add license-policy, fail-on, and sarif-file inputs for CI gating #11

	# SPDX-FileCopyrightText: Provenant contributors
	# SPDX-License-Identifier: Apache-2.0
	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	self-test:
	name: Self-test against a fixture
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

	# Runs this repository's action against the committed fixture and writes a
	# report file. This builds the wrapper image, which FROMs the published
	# ghcr.io/getprovenant/provenant image.
	- name: Run Provenant scan
	uses: ./
	with:
	paths: testdata/sample
	output-format: json-pp
	output-file: provenant-results.json
	args: --license --package --copyright

	- name: Assert the scan produced output
	run: \|
	if [ ! -s provenant-results.json ]; then
	echo "::error::Scan produced no output file."
	exit 1
	fi
	echo "Scan produced $(wc -c < provenant-results.json) bytes of output:"
	head -c 2000 provenant-results.json

Navigation Menu