action.yml

name: PQCensus audit
description: Run PQCensus evidence-grounded cryptographic inventory and post-quantum readiness analysis, then emit SARIF.
author: XiantingWu
inputs:
  path:
    description: Repository-relative path to inspect.
    required: false
    default: .
  output:
    description: Directory for JSON, native/CycloneDX CBOM, migration, and SARIF artifacts.
    required: false
    default: pqcensus-results
  fail-on:
    description: Minimum active severity that fails the step, or none.
    required: false
    default: high
  baseline:
    description: Optional PQCensus baseline JSON path.
    required: false
    default: ""
runs:
  using: composite
  steps:
    - name: Set up Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.11"
    - name: Install PQCensus in an isolated action environment
      shell: bash
      env:
        PQCENSUS_ACTION_PATH: ${{ github.action_path }}
        PQCENSUS_ACTION_VENV: ${{ runner.temp }}/pqcensus-action-${{ github.run_id }}-${{ github.job }}
      run: |
        set -euo pipefail
        VENV="$PQCENSUS_ACTION_VENV"
        rm -rf "$VENV"
        python -m venv "$VENV"
        if [[ -x "$VENV/bin/python" ]]; then
          BIN="$VENV/bin"
        else
          BIN="$VENV/Scripts"
        fi
        "$BIN/python" -m pip install --disable-pip-version-check --no-deps "$PQCENSUS_ACTION_PATH"
    - name: Audit repository
      shell: bash
      env:
        PQCENSUS_PATH: ${{ inputs.path }}
        PQCENSUS_OUTPUT: ${{ inputs.output }}
        PQCENSUS_FAIL_ON: ${{ inputs.fail-on }}
        PQCENSUS_BASELINE: ${{ inputs.baseline }}
        PQCENSUS_ACTION_VENV: ${{ runner.temp }}/pqcensus-action-${{ github.run_id }}-${{ github.job }}
      run: |
        set -euo pipefail
        args=(audit "$PQCENSUS_PATH" --output "$PQCENSUS_OUTPUT" --fail-on "$PQCENSUS_FAIL_ON" --quiet)
        if [[ -n "$PQCENSUS_BASELINE" ]]; then
          args+=(--baseline "$PQCENSUS_BASELINE")
        fi
        if [[ -x "$PQCENSUS_ACTION_VENV/bin/python" ]]; then
          ACTION_PYTHON="$PQCENSUS_ACTION_VENV/bin/python"
        else
          ACTION_PYTHON="$PQCENSUS_ACTION_VENV/Scripts/python.exe"
        fi
        "$ACTION_PYTHON" -m quantumguard "${args[@]}"