action.yml

# action.yml
name: 'Code-Pathfinder'
description: 'Security scanning with Code Pathfinder - open source, type-aware SAST with cross-file dataflow analysis'
author: 'Shivasurya <shiva@shivasurya.me>'
branding:
  icon: "shield"
  color: "blue"

inputs:
  rules:
    description: 'Path to Python SDK rules file or directory'
    required: false
  ruleset:
    description: 'Remote ruleset(s) to use (e.g., python/flask, docker/security). Can specify multiple comma-separated.'
    required: false
  project:
    description: 'Path to source code to scan'
    required: false
    default: '.'
  output:
    description: 'Output format: sarif, json, or csv'
    required: false
    default: 'sarif'
  output-file:
    description: 'Output file path (e.g., results.sarif)'
    required: false
    default: 'pathfinder-results.sarif'
  fail-on:
    description: 'Fail with exit code 1 if findings match severities (e.g., critical,high)'
    required: false
    default: ''
  verbose:
    description: 'Enable verbose output'
    required: false
    default: 'false'
  python-version:
    description: 'Python version to use'
    required: false
    default: '3.12'
  skip-tests:
    description: 'Skip scanning test files'
    required: false
    default: 'true'
  refresh-rules:
    description: 'Force refresh of cached rulesets (bypasses cache)'
    required: false
    default: 'false'
  debug:
    description: 'Enable debug diagnostics with timestamps'
    required: false
    default: 'false'
  disable-metrics:
    description: 'Disable anonymous usage metrics collection'
    required: false
    default: 'false'
  pr-comment:
    description: 'Post a summary comment on the pull request with scan results'
    required: false
    default: 'false'
  pr-inline:
    description: 'Post inline review comments for critical/high severity findings'
    required: false
    default: 'false'
  github-token:
    description: 'GitHub token for posting PR comments (required when pr-comment or pr-inline is enabled)'
    required: false
    default: ''
  no-diff:
    description: 'Disable diff-aware scanning (scan all files instead of only changed files)'
    required: false
    default: 'false'

outputs:
  results-file:
    description: 'Path to the output results file'
    value: ${{ inputs.output-file }}
  version:
    description: 'Installed pathfinder version'
    value: ${{ steps.install.outputs.version }}

runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ inputs.python-version }}

    - name: Install Code-Pathfinder
      id: install
      shell: bash
      run: |
        pip install --quiet codepathfinder
        VERSION=$(pathfinder version | head -1 | cut -d' ' -f2)
        echo "version=${VERSION}" >> $GITHUB_OUTPUT
        echo "Code-Pathfinder ${VERSION} installed successfully"

    - name: Run Security Scan
      shell: bash
      run: |
        set -euo pipefail

        # Input validation to prevent command injection
        # Check for dangerous shell metacharacters that could enable command injection
        validate_no_injection() {
          local input="$1"
          local field_name="$2"
          # Block shell command separators and substitution operators
          if [[ "$input" =~ [\;\|\&\$\`] ]] || [[ "$input" =~ $'\n' ]]; then
            echo "Error: Potentially dangerous characters detected in $field_name input"
            echo "Blocked characters: ; | & \$ \` (newline)"
            echo "These characters could be used for command injection"
            exit 1
          fi
        }

        # Validate that at least one rule source is provided
        if [ -z "${{ inputs.rules }}" ] && [ -z "${{ inputs.ruleset }}" ]; then
          echo "Error: Either 'rules' or 'ruleset' input must be specified"
          exit 1
        fi

        # Validate all user-provided inputs
        [ -n "${{ inputs.project }}" ] && validate_no_injection "${{ inputs.project }}" "project"
        [ -n "${{ inputs.rules }}" ] && validate_no_injection "${{ inputs.rules }}" "rules"
        [ -n "${{ inputs.ruleset }}" ] && validate_no_injection "${{ inputs.ruleset }}" "ruleset"
        [ -n "${{ inputs.output }}" ] && validate_no_injection "${{ inputs.output }}" "output"
        [ -n "${{ inputs.output-file }}" ] && validate_no_injection "${{ inputs.output-file }}" "output-file"
        [ -n "${{ inputs.fail-on }}" ] && validate_no_injection "${{ inputs.fail-on }}" "fail-on"
        [ -n "${{ inputs.github-token }}" ] && validate_no_injection "${{ inputs.github-token }}" "github-token"

        # Validate PR commenting requirements
        if [ "${{ inputs.pr-comment }}" = "true" ] || [ "${{ inputs.pr-inline }}" = "true" ]; then
          if [ -z "${{ inputs.github-token }}" ]; then
            echo "Error: 'github-token' input is required when 'pr-comment' or 'pr-inline' is enabled"
            exit 1
          fi
        fi

        # Build command arguments using array to prevent injection
        ARGS=(ci)
        ARGS+=(--project "${{ inputs.project }}")

        # Add rules or ruleset
        if [ -n "${{ inputs.rules }}" ]; then
          ARGS+=(--rules "${{ inputs.rules }}")
        fi

        if [ -n "${{ inputs.ruleset }}" ]; then
          # Split comma-separated rulesets and add each one
          IFS=',' read -ra RULESETS <<< "${{ inputs.ruleset }}"
          for ruleset in "${RULESETS[@]}"; do
            # Trim whitespace
            ruleset=$(echo "$ruleset" | xargs)
            # Skip empty entries (e.g., trailing commas)
            [ -z "$ruleset" ] && continue
            ARGS+=(--ruleset "$ruleset")
          done
        fi

        ARGS+=(--output "${{ inputs.output }}")
        ARGS+=(--output-file "${{ inputs.output-file }}")

        if [ "${{ inputs.verbose }}" = "true" ]; then
          ARGS+=(--verbose)
        fi

        if [ -n "${{ inputs.fail-on }}" ]; then
          ARGS+=(--fail-on "${{ inputs.fail-on }}")
        fi

        if [ "${{ inputs.skip-tests }}" = "true" ]; then
          ARGS+=(--skip-tests)
        else
          ARGS+=(--skip-tests=false)
        fi

        if [ "${{ inputs.refresh-rules }}" = "true" ]; then
          ARGS+=(--refresh-rules)
        fi

        if [ "${{ inputs.debug }}" = "true" ]; then
          ARGS+=(--debug)
        fi

        if [ "${{ inputs.disable-metrics }}" = "true" ]; then
          ARGS+=(--disable-metrics)
        fi

        if [ "${{ inputs.no-diff }}" = "true" ]; then
          ARGS+=(--no-diff)
        fi

        # PR commenting flags - auto-wire GitHub context
        if [ "${{ inputs.pr-comment }}" = "true" ] || [ "${{ inputs.pr-inline }}" = "true" ]; then
          # Validate PR number is available (empty on non-pull_request events)
          PR_NUMBER="${{ github.event.pull_request.number }}"
          if [ -z "$PR_NUMBER" ]; then
            echo "Error: PR commenting requires a pull_request event, but 'github.event.pull_request.number' is empty."
            echo "Hint: Use a conditional to only enable PR commenting on pull requests:"
            echo "  pr-comment: \${{ github.event_name == 'pull_request' }}"
            exit 1
          fi

          ARGS+=(--github-token "${{ inputs.github-token }}")
          ARGS+=(--github-repo "${{ github.repository }}")
          ARGS+=(--github-pr "$PR_NUMBER")

          if [ "${{ inputs.pr-comment }}" = "true" ]; then
            ARGS+=(--pr-comment)
          fi

          if [ "${{ inputs.pr-inline }}" = "true" ]; then
            ARGS+=(--pr-inline)
          fi
        fi

        pathfinder "${ARGS[@]}"