Function runPromptfooScan

code-scan-action/src/main.ts:317–364

(
  cliArgs: string[],
  oidcToken: string | undefined,
)

}

async function runPromptfooScan(
  cliArgs: string[],
  oidcToken: string | undefined,
): Promise<ScanResponse> {
  const installEnv = createSubprocessEnv();

  core.info('📦 Installing promptfoo...');
  await exec.exec('npm', ['install', '-g', 'promptfoo'], { env: installEnv });
  core.info('✅ Promptfoo installed successfully');

  core.info('🚀 Running promptfoo code-scans run...');

  let scanOutput = '';
  let scanError = '';
  const scanEnv = createScanEnv(oidcToken);

  const exitCode = await exec.exec('promptfoo', cliArgs, {
    env: scanEnv,
    listeners: {
      stdout: (data: Buffer) => {
        scanOutput += data.toString();
      },
      stderr: (data: Buffer) => {
        scanError += data.toString();
      },
    },
    ignoreReturnCode: true,
  });

  if (exitCode === 0) {
    core.info('✅ Scan completed successfully');
    return parseScanOutput(scanOutput);
  }

  // Keep compatibility with CLI releases that reported an authorized fork skip as text
  // while the action and CLI roll out independently.
  if (`${scanOutput}\n${scanError}`.includes('Fork PR scanning not authorized')) {
    return {
      success: true,
      comments: [],
      skipReason: FORK_PR_AUTH_SKIP_REASON,
    };
  }

  core.error(`CLI exited with code ${exitCode}`);
  core.error(`Error output: ${scanError}`);
  throw new Error(`Code scan failed with exit code ${exitCode}`);
}

function getScanResponse(cliArgs: string[], oidcToken: string | undefined): Promise<ScanResponse> {
  if (process.env.ACT === 'true') {