pr-scan.yml

name: Dependency scan

on:
  pull_request:
    branches: [main]

# One run per PR: rapid pushes must not interleave the sticky-comment find-then-post.
concurrency:
  group: pr-scan-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      # vetguard is published, but this dogfoods the flow from the local build so
      # it scans the code in the PR, not a released version. External consumers use
      # the published action (see README). This workflow is informational: it
      # tolerates exit 1 (findings) but fails on exit >= 2 (a scanner crash), so a
      # broken build cannot masquerade as a clean, empty report.
      - name: Scan dependencies (SARIF)
        run: |
          set +e
          node dist/cli.js scan . --sarif > vetguard.sarif
          code=$?
          set -e
          if [ "$code" -ge 2 ]; then echo "vetguard exited $code (scan error)"; exit "$code"; fi
      - name: Scan dependencies (summary + sticky PR comment)
        env:
          GH_TOKEN: ${{ github.token }}
          PR: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          set +e
          node dist/cli.js scan . --markdown | tee vetguard-report.md >> "$GITHUB_STEP_SUMMARY"
          code=${PIPESTATUS[0]}
          set -e
          if [ "$code" -ge 2 ]; then echo "vetguard exited $code (scan error)"; exit "$code"; fi
          # Match our marker AND the actions-bot author so a PR author cannot redirect the update.
          existing=$(gh api "repos/${REPO}/issues/${PR}/comments" \
            --jq 'map(select((.body | contains("<!-- vetguard-report -->")) and .user.login == "github-actions[bot]")) | .[0].id // empty' 2>/dev/null || true)
          if [ -n "$existing" ]; then
            gh api -X PATCH "repos/${REPO}/issues/comments/${existing}" -F body=@vetguard-report.md >/dev/null || true
          else
            gh api -X POST "repos/${REPO}/issues/${PR}/comments" -F body=@vetguard-report.md >/dev/null || true
          fi
      - name: Upload SARIF
        if: always()
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: vetguard.sarif