action.yml

name: 'PCI Payment Page Script Check'
description: 'Bounded PCI payment-page script inventory; fail CI on observed hosts outside your authorization list.'
author: 'Toledo Technologies LLC'
branding:
  icon: 'shield'
  color: 'blue'

inputs:
  url:
    description: 'Public https URL of the payment page to check. Use this or html-file.'
    required: false
    default: ''
  html-file:
    description: 'Relative path to UTF-8 HTML inside the workspace. Its contents are sent to the hosted check; never include credentials, card data, authenticated DOM state, or private source.'
    required: false
    default: ''
  page-origin:
    description: 'HTTPS page URL used to resolve relative script sources in html-file mode. It is not fetched in that mode.'
    required: false
    default: 'https://example.invalid/checkout'
  allowed-domains:
    description: 'Comma-separated hosts you have authorized to serve scripts, e.g. "js.stripe.com,www.googletagmanager.com". Leave blank for an inventory with no authorization check.'
    required: false
    default: ''
  fail-on:
    description: 'Fail the job when findings at this severity or above are present: high, medium, low, or never.'
    required: false
    default: 'high'
  payment-page-scope:
    description: 'Payment flow: direct, embedded processor form, outsourced redirect, or unspecified. Only direct can expose requirement-specific paid next steps.'
    required: false
    default: 'unspecified'
  api-base:
    description: 'Override the service endpoint. Only needed for self-hosting.'
    required: false
    default: 'https://qi.toledotechnologies.com'

outputs:
  passed:
    description: 'true when no finding met the fail-on threshold'
    value: ${{ steps.check.outputs.passed }}
  findings:
    description: 'Number of findings returned'
    value: ${{ steps.check.outputs.findings }}
  report:
    description: 'The full JSON result'
    value: ${{ steps.check.outputs.report }}

runs:
  using: 'composite'
  steps:
    - id: check
      shell: bash
      run: python3 "${{ github.action_path }}/scripts/check.py"
      env:
        INPUT_URL: ${{ inputs.url }}
        INPUT_HTML_FILE: ${{ inputs.html-file }}
        INPUT_PAGE_ORIGIN: ${{ inputs.page-origin }}
        INPUT_ALLOWED_DOMAINS: ${{ inputs.allowed-domains }}
        INPUT_FAIL_ON: ${{ inputs.fail-on }}
        INPUT_PAYMENT_PAGE_SCOPE: ${{ inputs.payment-page-scope }}
        INPUT_API_BASE: ${{ inputs.api-base }}