action.yml

name: 'agent-bom Scan'
description: 'Run agent-bom in CI/CD to scan AI agents, MCP servers, images, and IaC. Emit SARIF and map blast radius from packages to credentials and tools.'
author: 'agent-bom'

branding:
  icon: 'shield'
  color: 'green'

inputs:
  scan-type:
    description: 'Scan mode. Default `scan` runs the full agent/MCP discovery pipeline. Focused modes: image, fs, iac, sbom, secrets, code, agents, and skills.'
    required: false
    default: 'scan'
  scan-ref:
    description: 'Target reference for focused modes — image reference, filesystem path, SBOM file path, or IaC paths (comma-separated). Not required for the default `scan` mode.'
    required: false
    default: ''
  severity-threshold:
    description: 'Fail if vulnerabilities at or above this severity (critical, high, medium, low). Empty = no gate.'
    required: false
    default: ''
  warn-on-severity:
    description: 'Warn (non-blocking) if vulnerabilities at or above this severity. Use with severity-threshold for two-tier gates.'
    required: false
    default: ''
  policy:
    description: 'Path to policy file (JSON/YAML) for policy-as-code gates.'
    required: false
    default: ''
  enrich:
    description: 'Enable NVD CVSS, EPSS, and CISA KEV enrichment.'
    required: false
    default: 'false'
  format:
    description: 'Output format. Core: sarif (default), json, html, cyclonedx, spdx. Plain/no-color: plain (alias: text). Other: console, mermaid, svg, graph, graph-html, badge, prometheus.'
    required: false
    default: 'sarif'
  output:
    description: 'Output file path for scan results. Default: agent-bom-results.sarif (for SARIF format).'
    required: false
    default: ''
  upload-sarif:
    description: 'Upload SARIF results to GitHub Security tab.'
    required: false
    default: 'false'
  auto-update-db:
    description: 'Auto-update vulnerability database if stale (>7 days). Disable for air-gapped or fully cached runs.'
    required: false
    default: 'true'
  fail-on-kev:
    description: 'Fail if any CISA Known Exploited Vulnerability is found.'
    required: false
    default: 'false'
  ai-enrich:
    description: 'Enable LLM-powered risk analysis (requires Ollama or API key).'
    required: false
    default: 'false'
  ai-model:
    description: 'LLM model for AI enrichment (e.g. ollama/llama3.2, openai/gpt-4o-mini).'
    required: false
    default: ''
  python-version:
    description: 'Python version to use.'
    required: false
    default: '3.11'
  agent-bom-version:
    description: 'agent-bom package version to install (for example 0.75.x). Empty = latest from PyPI.'
    required: false
    default: ''
  install-from-source:
    description: 'Install agent-bom from local source (pyproject.toml) instead of PyPI. Use in CI dogfood to test unreleased code.'
    required: false
    default: 'false'
  image:
    description: 'Docker image to scan (e.g. nginx:1.25).'
    required: false
    default: ''
  config-dir:
    description: 'Path to MCP config directory to scan.'
    required: false
    default: ''
  sbom:
    description: 'Path to existing SBOM file (CycloneDX or SPDX JSON) to ingest.'
    required: false
    default: ''
  remediate:
    description: 'Generate remediation plan at this path (e.g. remediation.md).'
    required: false
    default: ''
  badge:
    description: 'Generate shields.io badge JSON at this path (e.g. agent-bom-badge.json).'
    required: false
    default: ''
  pr-comment:
    description: 'Post a findings summary comment on the pull request (requires GITHUB_TOKEN with pull-requests: write).'
    required: false
    default: 'false'
  ignore-file:
    description: 'Path to ignore/allowlist file (default: .agent-bom-ignore.yaml). Suppress known false positives by CVE ID, package, or finding type.'
    required: false
    default: ''
  iac:
    description: 'Path(s) to scan for IaC misconfigurations (Dockerfile, Kubernetes, Terraform, CloudFormation). Comma-separated.'
    required: false
    default: ''
  ai-inventory:
    description: 'Path(s) to scan for AI component inventory (SDK imports, model references, deprecated models). Comma-separated.'
    required: false
    default: ''
  os-packages:
    description: 'Enable OS-level package scanning (dpkg/rpm/apk).'
    required: false
    default: 'false'
  baseline:
    description: 'Path to a baseline report JSON for delta scanning (only report new findings).'
    required: false
    default: ''
  skill-only:
    description: 'Scan ONLY skill/instruction files (CLAUDE.md, .cursorrules, AGENTS.md); skip agent/package/CVE scanning.'
    required: false
    default: 'false'
  fail-on-verdict:
    description: 'For scan-type=skills, fail if any scanned file reaches this trust verdict or worse (suspicious or malicious).'
    required: false
    default: ''
  gpu-scan:
    description: 'Enable GPU infrastructure scanning (NVIDIA NIM/CUDA containers, DCGM).'
    required: false
    default: 'false'
  exclude-unfixable:
    description: 'Exclude vulnerabilities without available fixes from SARIF output'
    required: false
    default: 'false'

outputs:
  sarif-file:
    description: 'Path to generated SARIF file (if format=sarif).'
    value: ${{ steps.scan.outputs.sarif_file }}
  exit-code:
    description: 'Scan process exit code.'
    value: ${{ steps.scan.outputs.exit_code }}
  scan-status:
    description: 'High-level scan status (clean, violations, or error).'
    value: ${{ steps.scan.outputs.scan_status }}
  vulnerability-count:
    description: 'Number of vulnerabilities found, or skill findings when scan-type=skills.'
    value: ${{ steps.scan.outputs.vuln_count }}
  badge-file:
    description: 'Path to generated badge JSON (if badge input is set).'
    value: ${{ steps.scan.outputs.badge_file }}

runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
      with:
        python-version: ${{ inputs.python-version }}
        cache: pip

    - name: Cache agent-bom vulnerability database
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.agent-bom/vulns.db
        key: agent-bom-vulndb-${{ runner.os }}-${{ inputs.python-version }}-v1
        restore-keys: |
          agent-bom-vulndb-${{ runner.os }}-

    - name: Install agent-bom
      shell: bash
      env:
        AGENT_BOM_VERSION: ${{ inputs.agent-bom-version }}
        AI_ENRICH: ${{ inputs.ai-enrich }}
        INSTALL_FROM_SOURCE: ${{ inputs.install-from-source }}
        HTTP_PROXY: ${{ env.HTTP_PROXY }}
        HTTPS_PROXY: ${{ env.HTTPS_PROXY }}
        NO_PROXY: ${{ env.NO_PROXY }}
        SSL_CERT_FILE: ${{ env.SSL_CERT_FILE }}
        REQUESTS_CA_BUNDLE: ${{ env.REQUESTS_CA_BUNDLE }}
        CURL_CA_BUNDLE: ${{ env.CURL_CA_BUNDLE }}
        PIP_CERT: ${{ env.PIP_CERT }}
      run: |
        if [ "$INSTALL_FROM_SOURCE" = "true" ]; then
          # Install from local source (pyproject.toml) — used by CI dogfood to test unreleased code
          if [ "$AI_ENRICH" = "true" ]; then
            pip install ".[ai-enrich]" packaging
          else
            pip install "." packaging
          fi
        else
          PKG="agent-bom"
          if [ -n "$AGENT_BOM_VERSION" ]; then
            PKG="agent-bom==$AGENT_BOM_VERSION"
          fi
          if [ "$AI_ENRICH" = "true" ]; then
            pip install "${PKG}[ai-enrich]" packaging
          else
            pip install "$PKG" packaging
          fi
        fi

    - name: Run agent-bom
      id: scan
      shell: bash
      env:
        HTTP_PROXY: ${{ env.HTTP_PROXY }}
        HTTPS_PROXY: ${{ env.HTTPS_PROXY }}
        NO_PROXY: ${{ env.NO_PROXY }}
        SSL_CERT_FILE: ${{ env.SSL_CERT_FILE }}
        REQUESTS_CA_BUNDLE: ${{ env.REQUESTS_CA_BUNDLE }}
        CURL_CA_BUNDLE: ${{ env.CURL_CA_BUNDLE }}
        PIP_CERT: ${{ env.PIP_CERT }}
        INPUT_SCAN_TYPE: ${{ inputs.scan-type }}
        INPUT_SCAN_REF: ${{ inputs.scan-ref }}
        INPUT_FORMAT: ${{ inputs.format }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_UPLOAD_SARIF: ${{ inputs.upload-sarif }}
        INPUT_SEVERITY: ${{ inputs.severity-threshold }}
        INPUT_WARN_ON: ${{ inputs.warn-on-severity }}
        INPUT_POLICY: ${{ inputs.policy }}
        INPUT_ENRICH: ${{ inputs.enrich }}
        INPUT_AUTO_UPDATE_DB: ${{ inputs.auto-update-db }}
        INPUT_FAIL_ON_KEV: ${{ inputs.fail-on-kev }}
        INPUT_AI_ENRICH: ${{ inputs.ai-enrich }}
        INPUT_AI_MODEL: ${{ inputs.ai-model }}
        INPUT_IMAGE: ${{ inputs.image }}
        INPUT_CONFIG_DIR: ${{ inputs.config-dir }}
        INPUT_SBOM: ${{ inputs.sbom }}
        INPUT_REMEDIATE: ${{ inputs.remediate }}
        INPUT_BADGE: ${{ inputs.badge }}
        INPUT_IGNORE_FILE: ${{ inputs.ignore-file }}
        INPUT_IAC: ${{ inputs.iac }}
        INPUT_AI_INVENTORY: ${{ inputs.ai-inventory }}
        INPUT_OS_PACKAGES: ${{ inputs.os-packages }}
        INPUT_BASELINE: ${{ inputs.baseline }}
        INPUT_SKILL_ONLY: ${{ inputs.skill-only }}
        INPUT_FAIL_ON_VERDICT: ${{ inputs.fail-on-verdict }}
        INPUT_GPU_SCAN: ${{ inputs.gpu-scan }}
        INPUT_EXCLUDE_UNFIXABLE: ${{ inputs.exclude-unfixable }}
      run: |
        # Determine output file path
        if [ -n "$INPUT_OUTPUT" ]; then
          RESULT_FILE="$INPUT_OUTPUT"
        else
          RESULT_FILE="agent-bom-results.sarif"
        fi

        trim_arg() {
          printf '%s' "$1" | xargs
        }

        validate_severity_choice() {
          case "$1" in
            critical|high|medium|low) return 0 ;;
            *)
              echo "::error::$2 must be one of: critical, high, medium, low"
              exit 1
              ;;
          esac
        }
        fail_unsupported_focused_mode() {
          echo "::error::scan-type=$INPUT_SCAN_TYPE does not support SARIF upload or vulnerability gates. Use format=json or format=console with upload-sarif=false and no severity/policy gates, or use scan-type=scan/image/fs/iac/sbom."
          exit 1
        }
        # Map scan-type to focused command
        #   scan  → agent-bom agents (full auto-detect, default)
        #   image → agent-bom image <ref>
        #   fs    → agent-bom fs <path>
        #   sbom  → agent-bom sbom <path>
        #   iac   → agent-bom iac <paths...>
        #   skills → agent-bom skills scan <path>
        case "${INPUT_SCAN_TYPE:-scan}" in
          image)
            if [ -z "$INPUT_SCAN_REF" ] && [ -n "$INPUT_IMAGE" ]; then
              INPUT_SCAN_REF="$INPUT_IMAGE"
            fi
            if [ -z "$INPUT_SCAN_REF" ]; then
              echo "::error::scan-type=image requires scan-ref (image reference) or image input"
              exit 1
            fi
            ARGS=(image "$INPUT_SCAN_REF")
            ;;
          fs)
            ARGS=(fs "${INPUT_SCAN_REF:-.}")
            ;;
          sbom)
            if [ -z "$INPUT_SCAN_REF" ] && [ -n "$INPUT_SBOM" ]; then
              INPUT_SCAN_REF="$INPUT_SBOM"
            fi
            if [ -z "$INPUT_SCAN_REF" ]; then
              echo "::error::scan-type=sbom requires scan-ref (SBOM file path) or sbom input"
              exit 1
            fi
            ARGS=(sbom "$INPUT_SCAN_REF")
            ;;
          iac)
            if [ -z "$INPUT_SCAN_REF" ] && [ -n "$INPUT_IAC" ]; then
              INPUT_SCAN_REF="$INPUT_IAC"
            fi
            if [ -z "$INPUT_SCAN_REF" ]; then
              echo "::error::scan-type=iac requires scan-ref (IaC paths) or iac input"
              exit 1
            fi
            ARGS=(iac)
            IFS=',' read -ra IAC_REFS <<< "$INPUT_SCAN_REF"
            for p in "${IAC_REFS[@]}"; do
              p="$(trim_arg "$p")"
              if [ -n "$p" ]; then
                ARGS+=("$p")
              fi
            done
            ;;
          secrets)
            ARGS=(secrets "${INPUT_SCAN_REF:-.}")
            ;;
          code)
            ARGS=(code "${INPUT_SCAN_REF:-.}")
            ;;
          agents)
            ARGS=(agents)
            ;;
          skills)
            ARGS=(skills scan "${INPUT_SCAN_REF:-.}")
            ;;
          scan|"")
            ARGS=(scan)
            ;;
          *)
            echo "::error::Unknown scan-type: $INPUT_SCAN_TYPE. Use: scan, image, fs, sbom, iac, secrets, code, agents, skills"
            exit 1
            ;;
        esac

        if [ "$INPUT_SCAN_TYPE" = "skills" ] && { [ -z "$INPUT_FORMAT" ] || [ "$INPUT_FORMAT" = "sarif" ]; }; then
          INPUT_FORMAT="json"
          if [ -z "$INPUT_OUTPUT" ]; then
            RESULT_FILE="agent-bom-results.json"
          fi
        fi

        if [ "$INPUT_SCAN_TYPE" = "skills" ] && [ -n "$INPUT_FORMAT" ] && [ "$INPUT_FORMAT" != "json" ] && [ "$INPUT_FORMAT" != "console" ]; then
          echo "::error::scan-type=skills only supports format=json or format=console"
          exit 1
        fi

        if [ "$INPUT_SCAN_TYPE" = "secrets" ] || [ "$INPUT_SCAN_TYPE" = "code" ]; then
          if [ -z "$INPUT_FORMAT" ] || [ "$INPUT_FORMAT" = "sarif" ]; then
            fail_unsupported_focused_mode
          fi
          [ "$INPUT_UPLOAD_SARIF" = "true" ] && fail_unsupported_focused_mode
          [ -n "$INPUT_SEVERITY" ] && fail_unsupported_focused_mode
          [ -n "$INPUT_WARN_ON" ] && fail_unsupported_focused_mode
          [ -n "$INPUT_POLICY" ] && fail_unsupported_focused_mode
          [ "$INPUT_FAIL_ON_KEV" = "true" ] && fail_unsupported_focused_mode
          [ "$INPUT_EXCLUDE_UNFIXABLE" = "true" ] && fail_unsupported_focused_mode
          [ "$INPUT_GPU_SCAN" = "true" ] && fail_unsupported_focused_mode
          [ "$INPUT_SKILL_ONLY" = "true" ] && fail_unsupported_focused_mode
        fi

        # Output format
        if [ "$INPUT_FORMAT" = "sarif" ]; then
          ARGS+=(-f sarif -o "$RESULT_FILE")
        elif [ -n "$INPUT_FORMAT" ]; then
          ARGS+=(-f "$INPUT_FORMAT")
          if [ -n "$INPUT_OUTPUT" ] || [ "$INPUT_SCAN_TYPE" = "skills" ]; then
            ARGS+=(-o "$RESULT_FILE")
          fi
        fi

        # Skills scans have their own narrower CLI surface and should not
        # inherit vulnerability-scan flags like --auto-update-db or --policy.
        if [ "$INPUT_SCAN_TYPE" != "skills" ]; then
          if [ "$INPUT_SCAN_TYPE" != "secrets" ] && [ "$INPUT_SCAN_TYPE" != "code" ]; then
            # Severity gate
            if [ -n "$INPUT_SEVERITY" ]; then
              validate_severity_choice "$INPUT_SEVERITY" "severity-threshold"
              ARGS+=(--fail-on-severity "$INPUT_SEVERITY")
            fi

            # Warn-on severity (non-blocking)
            if [ -n "$INPUT_WARN_ON" ]; then
              validate_severity_choice "$INPUT_WARN_ON" "warn-on-severity"
              ARGS+=(--warn-on "$INPUT_WARN_ON")
            fi

            # Policy file
            if [ -n "$INPUT_POLICY" ]; then
              ARGS+=(--policy "$INPUT_POLICY")
            fi

            # Enrichment
            if [ "$INPUT_ENRICH" = "true" ]; then
              ARGS+=(--enrich)
            fi

            # Auto-update vulnerability database
            if [ "$INPUT_AUTO_UPDATE_DB" = "true" ]; then
              ARGS+=(--auto-update-db)
            fi

            # KEV gate
            if [ "$INPUT_FAIL_ON_KEV" = "true" ]; then
              ARGS+=(--fail-on-kev)
            fi

            # Docker image (skip if scan-type=image — already in command)
            if [ -n "$INPUT_IMAGE" ] && [ "$INPUT_SCAN_TYPE" != "image" ]; then
              ARGS+=(--image "$INPUT_IMAGE")
            fi

            # Config directory
            if [ -n "$INPUT_CONFIG_DIR" ]; then
              ARGS+=(--config-dir "$INPUT_CONFIG_DIR")
            fi

            # Existing SBOM (skip if scan-type=sbom — already in command)
            if [ -n "$INPUT_SBOM" ] && [ "$INPUT_SCAN_TYPE" != "sbom" ]; then
              ARGS+=(--sbom "$INPUT_SBOM")
            fi

            # Remediation plan
            if [ -n "$INPUT_REMEDIATE" ]; then
              ARGS+=(--remediate "$INPUT_REMEDIATE")
            fi

            # AI enrichment
            if [ "$INPUT_AI_ENRICH" = "true" ]; then
              ARGS+=(--ai-enrich)
              if [ -n "$INPUT_AI_MODEL" ]; then
                ARGS+=(--ai-model "$INPUT_AI_MODEL")
              fi
            fi

            # Ignore file
            if [ -n "$INPUT_IGNORE_FILE" ]; then
              ARGS+=(--ignore-file "$INPUT_IGNORE_FILE")
            fi

            # IaC scanning paths (skip if scan-type=iac — already in command)
            if [ -n "$INPUT_IAC" ] && [ "$INPUT_SCAN_TYPE" != "iac" ]; then
              IFS=',' read -ra IAC_PATHS <<< "$INPUT_IAC"
              for p in "${IAC_PATHS[@]}"; do
                p="$(trim_arg "$p")"
                if [ -n "$p" ]; then
                  ARGS+=(--iac "$p")
                fi
              done
            fi

            # AI inventory scanning paths
            if [ -n "$INPUT_AI_INVENTORY" ]; then
              IFS=',' read -ra AI_PATHS <<< "$INPUT_AI_INVENTORY"
              for p in "${AI_PATHS[@]}"; do
                p="$(trim_arg "$p")"
                if [ -n "$p" ]; then
                  ARGS+=(--ai-inventory "$p")
                fi
              done
            fi

            # OS package scanning
            if [ "$INPUT_OS_PACKAGES" = "true" ]; then
              ARGS+=(--os-packages)
            fi

            # Delta scanning baseline
            if [ -n "$INPUT_BASELINE" ]; then
              ARGS+=(--baseline "$INPUT_BASELINE" --delta-mode new-only)
            fi
          fi
        fi

        # Skill-only mode
        if [ "$INPUT_SKILL_ONLY" = "true" ] && [ "$INPUT_SCAN_TYPE" != "skills" ]; then
          ARGS+=(--skill-only)
        fi

        # Skills verdict gate
        if [ -n "$INPUT_FAIL_ON_VERDICT" ]; then
          if [ "$INPUT_FAIL_ON_VERDICT" != "suspicious" ] && [ "$INPUT_FAIL_ON_VERDICT" != "malicious" ]; then
            echo "::error::fail-on-verdict must be one of: suspicious, malicious"
            exit 1
          fi
          if [ "$INPUT_SCAN_TYPE" = "skills" ]; then
            ARGS+=(--fail-on-verdict "$INPUT_FAIL_ON_VERDICT")
          else
            echo "::warning::fail-on-verdict only applies to scan-type=skills and will be ignored"
          fi
        fi

        # GPU infrastructure scanning
        if [ "$INPUT_GPU_SCAN" = "true" ]; then
          ARGS+=(--gpu-scan)
        fi

        # Exclude unfixable findings from SARIF output
        if [ "$INPUT_EXCLUDE_UNFIXABLE" = "true" ]; then
          ARGS+=(--exclude-unfixable)
        fi

        # Run scan, capture exit code
        set +e
        echo "::group::agent-bom command"
        printf 'Running:'
        for arg in "${ARGS[@]}"; do
          printf ' %q' "$arg"
        done
        printf '\n'
        echo "::endgroup::"
        agent-bom "${ARGS[@]}"
        EXIT_CODE=$?
        set -e

        SARIF_FILE=""
        VULN_COUNT=0
        if [ "$INPUT_FORMAT" = "sarif" ] && [ -f "$RESULT_FILE" ]; then
          SARIF_FILE="$RESULT_FILE"
          VULN_COUNT=$(python3 -c "import json; d=json.load(open('$RESULT_FILE')); print(len(d.get('runs',[{}])[0].get('results',[])))" 2>/dev/null || echo 0)
        elif [ "$INPUT_SCAN_TYPE" = "skills" ] && [ -f "$RESULT_FILE" ]; then
          VULN_COUNT=$(python3 -c "import json; d=json.load(open('$RESULT_FILE')); print(d.get('summary',{}).get('findings',0))" 2>/dev/null || echo 0)
        fi

        SCAN_STATUS="error"
        if [ "$EXIT_CODE" = "0" ]; then
          SCAN_STATUS="clean"
        elif [ "$VULN_COUNT" -gt 0 ]; then
          SCAN_STATUS="violations"
        fi

        # Generate badge from SARIF results (no second scan)
        BADGE_FILE=""
        if [ -n "$INPUT_BADGE" ] && [ -f "$SARIF_FILE" ]; then
          python3 -c "
        import json, sys
        try:
            sarif = json.load(open('$SARIF_FILE'))
            run = sarif.get('runs', [{}])[0]
            results = run.get('results', [])
            rules = {r['id']: r for r in run.get('tool', {}).get('driver', {}).get('rules', [])}
            critical = high = 0
            for r in results:
                rid = r.get('ruleId', '')
                rule = rules.get(rid, {})
                score = float(rule.get('properties', {}).get('security-severity', '0'))
                if score > 9.0: critical += 1
                elif score >= 7.0: high += 1
            total = len(results)
            if critical > 0:
                color, msg = 'critical', f'{critical} critical, {high} high'
            elif high > 0:
                color, msg = 'orange', f'{high} high, {total} total'
            elif total > 0:
                color, msg = 'yellow', f'{total} findings'
            else:
                color, msg = 'brightgreen', 'clean'
            badge = {'schemaVersion': 1, 'label': 'agent-bom', 'message': msg, 'color': color, 'namedLogo': 'shield'}
            with open('$INPUT_BADGE', 'w') as f:
                json.dump(badge, f, indent=2)
        except Exception as e:
            print(f'Badge generation failed: {e}', file=sys.stderr)
        " || echo "::warning::Badge generation failed"
          if [ -f "$INPUT_BADGE" ]; then
            BADGE_FILE="$INPUT_BADGE"
          fi
        fi

        echo "sarif_file=$SARIF_FILE" >> "$GITHUB_OUTPUT"
        echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
        echo "scan_status=$SCAN_STATUS" >> "$GITHUB_OUTPUT"
        echo "vuln_count=$VULN_COUNT" >> "$GITHUB_OUTPUT"
        echo "badge_file=$BADGE_FILE" >> "$GITHUB_OUTPUT"

        if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
          {
            echo "## agent-bom scan summary"
            echo ""
            echo "| Field | Value |"
            echo "|---|---|"
            echo "| Scan type | \`${INPUT_SCAN_TYPE:-scan}\` |"
            echo "| Format | \`${INPUT_FORMAT:-sarif}\` |"
            echo "| Status | \`${SCAN_STATUS}\` |"
            echo "| Exit code | \`${EXIT_CODE}\` |"
            echo "| Finding count | \`${VULN_COUNT}\` |"
            echo "| Proxy/CA env passthrough | \`HTTP_PROXY, HTTPS_PROXY, NO_PROXY, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, PIP_CERT\` |"
            if [ -n "$RESULT_FILE" ] && [ -f "$RESULT_FILE" ]; then
              echo "| Result file | \`${RESULT_FILE}\` |"
            fi
            if [ -n "$SARIF_FILE" ]; then
              echo "| SARIF file | \`${SARIF_FILE}\` |"
            fi
            if [ -n "$BADGE_FILE" ]; then
              echo "| Badge file | \`${BADGE_FILE}\` |"
            fi
          } >> "$GITHUB_STEP_SUMMARY"
        fi

        exit $EXIT_CODE

    - name: Post PR comment with findings summary
      if: inputs.pr-comment == 'true' && github.event_name == 'pull_request'
      shell: python
      env:
        GH_TOKEN: ${{ github.token }}
        SARIF_FILE: ${{ steps.scan.outputs.sarif_file }}
        VULN_COUNT: ${{ steps.scan.outputs.vuln_count }}
        EXIT_CODE: ${{ steps.scan.outputs.exit_code }}
        PR_NUMBER: ${{ github.event.pull_request.number }}
        REPO: ${{ github.repository }}
      run: |
        import html, json, os, subprocess

        marker = "<!-- agent-bom-scan-comment -->"
        sarif_file = os.environ.get("SARIF_FILE", "")
        exit_code = os.environ.get("EXIT_CODE", "0")
        vuln_count = os.environ.get("VULN_COUNT", "0")
        pr_number = os.environ.get("PR_NUMBER", "")
        repo = os.environ.get("REPO", "")

        status = "✅ Clean — no violations found" if exit_code == "0" else f"⚠️ {vuln_count} vulnerability finding(s)"

        def _sanitize_md(value: str) -> str:
            text = html.escape(value or "", quote=False)
            return text.replace("`", "'").replace("\r", " ").replace("\n", " ")

        # Map SARIF security-severity scores to agent-bom severity labels
        def _score_to_severity(score: float) -> str:
            if score > 9.0:
                return "CRITICAL"
            if score >= 7.0:
                return "HIGH"
            if score >= 4.0:
                return "MEDIUM"
            if score >= 0.1:
                return "LOW"
            return "NONE"

        findings_lines = []
        if sarif_file and os.path.isfile(sarif_file):
            try:
                sarif = json.load(open(sarif_file))
                run = sarif.get("runs", [{}])[0]
                results = run.get("results", [])
                rules = {r["id"]: r for r in run.get("tool", {}).get("driver", {}).get("rules", [])}
                for r in results[:10]:
                    rule_id = r.get("ruleId", "")
                    rule = rules.get(rule_id, {})
                    score = float(rule.get("properties", {}).get("security-severity", "0"))
                    severity = _score_to_severity(score)
                    msg = r.get("message", {}).get("text", "")
                    findings_lines.append(
                        f"- **{_sanitize_md(severity)}** `{_sanitize_md(rule_id)}` — {_sanitize_md(msg)}"
                    )
                if len(results) > 10:
                    findings_lines.append(f"- ... and {len(results) - 10} more")
            except Exception:
                pass

        findings_text = "\n".join(findings_lines) if findings_lines else "No findings."
        body = f"{marker}\n## agent-bom Security Scan\n\n**Status:** {status}\n\n### Findings\n{findings_text}\n\n<sub>Generated by [agent-bom](https://github.com/msaad00/agent-bom)</sub>"

        result = subprocess.run(
            ["gh", "api", f"repos/{repo}/issues/{pr_number}/comments", "--jq", f'.[] | select(.body | contains("{marker}")) | .id'],
            capture_output=True, text=True
        )
        existing_id = result.stdout.strip().splitlines()[0] if result.stdout.strip() else ""

        if existing_id:
            subprocess.run(["gh", "api", f"repos/{repo}/issues/comments/{existing_id}", "-X", "PATCH", "-f", f"body={body}"], check=True)
        else:
            subprocess.run(["gh", "api", f"repos/{repo}/issues/{pr_number}/comments", "-f", f"body={body}"], check=True)

    - name: Detect SARIF output
      id: sarif
      if: always()
      shell: bash
      run: |
        SARIF_FILE="${{ steps.scan.outputs.sarif_file }}"
        if [ -n "$SARIF_FILE" ] && [ -f "$SARIF_FILE" ]; then
          echo "exists=true" >> "$GITHUB_OUTPUT"
          echo "path=$SARIF_FILE" >> "$GITHUB_OUTPUT"
        else
          echo "exists=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Upload SARIF to GitHub Security tab
      if: inputs.upload-sarif == 'true' && always() && steps.sarif.outputs.exists == 'true'
      uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
      with:
        sarif_file: ${{ steps.sarif.outputs.path }}
        category: agent-bom