Function runCodeScan

code-scan-action/src/main.ts:714–758

()

}

async function runCodeScan(): Promise<void> {
  const inputs = getActionInputs();

  if (shouldSkipForkPullRequest(inputs.enableForkPrs)) {
    core.info('🔀 Fork PR detected and enable-fork-prs is false; skipping Promptfoo Code Scan');
    core.info(
      'A maintainer can trigger a scan by commenting @promptfoo-scanner, or enable fork PR scans with enable-fork-prs: true',
    );
    return;
  }

  const guidance = loadGuidance(inputs);

  core.info('🔍 Starting Promptfoo Code Scan...');

  const context = await getGitHubContext(inputs.githubToken);
  core.info(`📋 Scanning PR #${context.number} in ${context.owner}/${context.repo}`);

  core.info('🔎 Checking if this is a setup PR...');
  const files = await getPRFiles(inputs.githubToken, context);

  if (isSetupPR(files)) {
    core.info('✅ Setup PR detected - workflow file will be added on merge');
    return;
  }

  core.info('✅ Not a setup PR - proceeding with security scan');

  const oidcToken = await authenticateWithOidc();

  const finalConfigPath = resolveConfigPath(inputs.configPath, inputs.minimumSeverity, guidance);

  try {
    const baseBranch = await getBaseBranch(inputs.githubToken, context);
    await fetchBaseBranch(baseBranch);

    const cliArgs = buildCliArgs(inputs.apiHost, finalConfigPath, baseBranch, context);
    const scanResponse = await getScanResponse(cliArgs, oidcToken);

    await handleScanResponse(scanResponse, inputs, context);
    logActCommentPreview(scanResponse.comments);
  } finally {
    cleanupConfig(inputs.configPath, finalConfigPath);
  }
}

async function run(): Promise<void> {
  try {