buildDetectionGuardStep creates a guard step that checks if detection should run. Uses always() to run even if the agent job failed (detection still analyzes whatever output exists). In the separate detection job, output metadata is read from the agent job's outputs.
()
| 119 | // Uses always() to run even if the agent job failed (detection still analyzes whatever output exists). |
| 120 | // In the separate detection job, output metadata is read from the agent job's outputs. |
| 121 | func (c *Compiler) buildDetectionGuardStep() []string { |
| 122 | return []string{ |
| 123 | " - name: Check if detection needed\n", |
| 124 | " id: detection_guard\n", |
| 125 | " if: always()\n", |
| 126 | " env:\n", |
| 127 | " OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}\n", |
| 128 | " HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n", |
| 129 | " run: |\n", |
| 130 | " if [[ -n \"$OUTPUT_TYPES\" || \"$HAS_PATCH\" == \"true\" ]]; then\n", |
| 131 | " echo \"run_detection=true\" >> \"$GITHUB_OUTPUT\"\n", |
| 132 | " echo \"Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH\"\n", |
| 133 | " else\n", |
| 134 | " echo \"run_detection=false\" >> \"$GITHUB_OUTPUT\"\n", |
| 135 | " echo \"Detection skipped: no agent outputs or patches to analyze\"\n", |
| 136 | " fi\n", |
| 137 | } |
| 138 | } |
| 139 | |
| 140 | // buildClearMCPConfigStep creates a step that removes MCP configuration files. |
| 141 | // This ensures the detection engine runs without any MCP servers. |
no outgoing calls