action.yml

name: 'Adversarial Debate Security Analysis'
description: 'AI Red Team Security Testing using adversarial agent mesh'
author: 'Gareth Roberts'

branding:
  icon: 'shield'
  color: 'red'

inputs:
  target:
    description: 'File or directory to analyze'
    required: false
    default: '.'

  agent:
    description: 'Single agent to run (exploit, break, chaos) or "all" for full pipeline'
    required: false
    default: 'all'

  provider:
    description: 'LLM provider (anthropic, openai, azure, ollama, mock)'
    required: false
    default: 'anthropic'

  anthropic-api-key:
    description: 'Anthropic API key (if using anthropic provider)'
    required: false

  openai-api-key:
    description: 'OpenAI API key (if using openai provider)'
    required: false

  azure-openai-key:
    description: 'Azure OpenAI API key (if using azure provider)'
    required: false

  azure-openai-endpoint:
    description: 'Azure OpenAI endpoint URL (if using azure provider)'
    required: false

  output-format:
    description: 'Output format (json, sarif, html, markdown)'
    required: false
    default: 'sarif'

  output-file:
    description: 'Output file path'
    required: false
    default: 'security-analysis.sarif'

  baseline-file:
    description: 'Path to baseline bundle (in repo) used for PR regression gating'
    required: false
    default: '.adversarial-baseline.json'

  baseline-mode:
    description: 'Baseline gating mode (off, only-new)'
    required: false
    default: 'only-new'

  fail-on-findings:
    description: 'Fail the action if security findings are detected'
    required: false
    default: 'true'

  severity-threshold:
    description: 'Minimum severity to fail on (critical, high, medium, low)'
    required: false
    default: 'high'

  time-budget:
    description: 'Time budget in seconds for analysis'
    required: false
    default: '300'

  python-version:
    description: 'Python version to use'
    required: false
    default: '3.11'

outputs:
  findings-count:
    description: 'Total number of security findings'
    value: ${{ steps.analyze.outputs.findings-count }}

  critical-count:
    description: 'Number of critical severity findings'
    value: ${{ steps.analyze.outputs.critical-count }}

  high-count:
    description: 'Number of high severity findings'
    value: ${{ steps.analyze.outputs.high-count }}

  verdict:
    description: 'Overall verdict (BLOCK, WARN, PASS)'
    value: ${{ steps.analyze.outputs.verdict }}

  output-file:
    description: 'Path to the output file'
    value: ${{ steps.analyze.outputs.output-file }}

runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ inputs.python-version }}

    - name: Install adversarial-debate (from action source)
      shell: bash
      run: |
        set -euo pipefail
        PROVIDER="${{ inputs.provider }}"
        if [ "$PROVIDER" = "openai" ] || [ "$PROVIDER" = "azure" ]; then
          pip install "$GITHUB_ACTION_PATH[openai]"
        else
          pip install "$GITHUB_ACTION_PATH"
        fi

    - name: Run security analysis
      id: analyze
      shell: bash
      env:
        ANTHROPIC_API_KEY: ${{ inputs.anthropic-api-key }}
        OPENAI_API_KEY: ${{ inputs.openai-api-key }}
        AZURE_OPENAI_API_KEY: ${{ inputs.azure-openai-key }}
        AZURE_OPENAI_ENDPOINT: ${{ inputs.azure-openai-endpoint }}
        LLM_PROVIDER: ${{ inputs.provider }}
      run: |
        set +e

        TARGET="${{ inputs.target }}"
        OUTPUT_FILE="${{ inputs.output-file }}"
        FORMAT="${{ inputs.output-format }}"
        AGENT="${{ inputs.agent }}"
        BASELINE_FILE="${{ inputs.baseline-file }}"
        BASELINE_MODE="${{ inputs.baseline-mode }}"

        # Always write a canonical bundle for downstream parsing
        BUNDLE_FILE="results.bundle.json"

        if [ "$AGENT" = "all" ]; then
          adversarial-debate run "$TARGET" \
            --time-budget "${{ inputs.time-budget }}" \
            --bundle-file "$BUNDLE_FILE" \
            --report-file "$OUTPUT_FILE" \
            --format "$FORMAT" \
            --baseline-mode "$BASELINE_MODE" \
            --baseline-file "$BASELINE_FILE" \
            --min-severity "${{ inputs.severity-threshold }}" \
            --fail-on never
          TOOL_EXIT=$?
        else
          adversarial-debate --json-output --output results.raw.json analyze "$AGENT" "$TARGET"
          TOOL_EXIT=$?

          python3 - <<'PY'
import json
from datetime import UTC, datetime
from pathlib import Path

from adversarial_debate.results import (
    normalize_break_findings,
    normalize_chaos_experiments,
    normalize_exploit_findings,
)

raw = json.loads(Path("results.raw.json").read_text())
agent = "${{ inputs.agent }}"

if agent == "exploit":
    findings = normalize_exploit_findings(raw.get("findings", []))
elif agent == "break":
    findings = normalize_break_findings(raw.get("findings", []), target_file_path="${{ inputs.target }}")
elif agent == "chaos":
    findings = normalize_chaos_experiments(raw.get("experiments", []))
else:
    findings = []

severity_counts = {}
for f in findings:
    sev = str(f.get("severity", "UNKNOWN")).upper()
    severity_counts[sev] = severity_counts.get(sev, 0) + 1

bundle = {
    "metadata": {
        "run_id": f"action-{agent}-{datetime.now(UTC).strftime('%Y%m%d%H%M%S')}",
        "target": "${{ inputs.target }}",
        "provider": "${{ inputs.provider }}",
        "started_at": datetime.now(UTC).isoformat(),
        "finished_at": datetime.now(UTC).isoformat(),
        "files_analyzed": [],
        "time_budget_seconds": int("${{ inputs.time-budget }}"),
        "finding_counts": {"total": len(findings), "by_severity": severity_counts},
    },
    "findings": findings,
    "verdict": {},
}
Path("results.bundle.json").write_text(json.dumps(bundle, indent=2))
PY

          python3 - <<'PY'
import json
from pathlib import Path
from adversarial_debate.formatters import FormatterConfig, get_formatter

bundle = json.loads(Path("results.bundle.json").read_text())
fmt = "${{ inputs.output-format }}"
out = "${{ inputs.output-file }}"

formatter = get_formatter(fmt, FormatterConfig(tool_name="adversarial-debate"))
Path(out).write_text(formatter.format(bundle))
PY
        fi

        set -e

        python3 - <<'PY'
import json
import os
from pathlib import Path

bundle = json.loads(Path("results.bundle.json").read_text())
baseline = bundle.get("baseline") or {}

if baseline.get("mode") == "only-new" and isinstance(baseline.get("new"), list):
    findings = baseline.get("new") or []
    total = len(findings)
    by_sev = {}
    for f in findings:
        sev = str((f or {}).get("severity", "UNKNOWN")).upper()
        by_sev[sev] = by_sev.get(sev, 0) + 1
else:
    counts = (bundle.get("metadata") or {}).get("finding_counts") or {}
    by_sev = counts.get("by_severity") or {}
    total = counts.get("total", 0)

verdict = bundle.get("verdict") or {}
summary = verdict.get("summary") or {}
decision = summary.get("decision", "UNKNOWN")

out_path = os.environ["GITHUB_OUTPUT"]
with open(out_path, "a") as f:
    f.write(f"findings-count={total}\n")
    f.write(f"critical-count={by_sev.get('CRITICAL', 0)}\n")
    f.write(f"high-count={by_sev.get('HIGH', 0)}\n")
    f.write(f"verdict={decision}\n")
    f.write(f"output-file=${{ inputs.output-file }}\n")
PY

        echo "tool-exit=$TOOL_EXIT" >> $GITHUB_OUTPUT

    - name: Upload SARIF to GitHub Security
      if: inputs.output-format == 'sarif'
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ inputs.output-file }}
      continue-on-error: true

    - name: Check severity threshold
      if: inputs.fail-on-findings == 'true'
      shell: bash
      run: |
        VERDICT="${{ steps.analyze.outputs.verdict }}"
        THRESHOLD="${{ inputs.severity-threshold }}"
        CRITICAL="${{ steps.analyze.outputs.critical-count }}"
        HIGH="${{ steps.analyze.outputs.high-count }}"

        SHOULD_FAIL=false

        case "$THRESHOLD" in
          critical)
            if [ "$CRITICAL" -gt 0 ]; then
              SHOULD_FAIL=true
            fi
            ;;
          high)
            if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
              SHOULD_FAIL=true
            fi
            ;;
          medium|low)
            if [ "$VERDICT" = "BLOCK" ] || [ "$VERDICT" = "WARN" ]; then
              SHOULD_FAIL=true
            fi
            ;;
        esac

        if [ "$SHOULD_FAIL" = "true" ]; then
          echo "::error::Security findings exceed threshold ($THRESHOLD)"
          echo "Verdict: $VERDICT"
          echo "Critical: $CRITICAL, High: $HIGH"
          exit 1
        fi