action.yml

name: "cloud-audit - AWS Security Scanner"
description: "Scan your AWS account for security misconfigurations with attack chain detection, Terraform remediation, and SARIF output"

branding:
  icon: shield
  color: blue

inputs:
  cloud-audit-version:
    description: "Pin cloud-audit to a specific PyPI version (e.g. 2.3.0). Default matches the action's release tag for reproducible builds."
    required: false
    default: "2.3.0"
  format:
    description: "Output format: sarif, json, html, markdown"
    required: false
    default: "sarif"
  output:
    description: "Output file path"
    required: false
    default: "results.sarif"
  regions:
    description: "Comma-separated AWS regions to scan (empty = default region)"
    required: false
    default: ""
  remediation:
    description: "Show remediation details in console output"
    required: false
    default: "false"
  fail-on-findings:
    description: "Fail the workflow if security findings are detected"
    required: false
    default: "true"
  diff-baseline:
    description: "Path to a baseline scan JSON file for diff comparison"
    required: false
    default: ""
  extra-args:
    description: "Additional arguments passed to cloud-audit scan"
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Install cloud-audit
      shell: bash
      env:
        CLOUD_AUDIT_VERSION: ${{ inputs.cloud-audit-version }}
      run: |
        if [ -z "$CLOUD_AUDIT_VERSION" ]; then
          echo "::error::cloud-audit-version input must not be empty"
          exit 2
        fi
        # Reject anything outside [0-9A-Za-z.+-] to prevent injection via pip spec
        case "$CLOUD_AUDIT_VERSION" in
          *[!0-9A-Za-z.+\-]*)
            echo "::error::Refusing to install cloud-audit==$CLOUD_AUDIT_VERSION - illegal characters in version"
            exit 2
            ;;
        esac
        pip install "cloud-audit==${CLOUD_AUDIT_VERSION}"

    - name: Run cloud-audit scan
      id: scan
      shell: bash
      env:
        INPUT_FORMAT: ${{ inputs.format }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_REGIONS: ${{ inputs.regions }}
        INPUT_REMEDIATION: ${{ inputs.remediation }}
        INPUT_FAIL_ON_FINDINGS: ${{ inputs.fail-on-findings }}
        INPUT_EXTRA_ARGS: ${{ inputs.extra-args }}
      run: |
        set +e

        ARGS=(--provider aws --format "$INPUT_FORMAT" --output "$INPUT_OUTPUT")

        if [ -n "$INPUT_REGIONS" ]; then
          ARGS+=(--regions "$INPUT_REGIONS")
        fi

        if [ "$INPUT_REMEDIATION" = "true" ]; then
          ARGS+=(--remediation)
        fi

        # Word-split extra-args on whitespace into argv entries. The values stay in
        # argv (not the shell), so a malicious workflow author can pass odd flags
        # but cannot break out of the cloud-audit invocation.
        if [ -n "$INPUT_EXTRA_ARGS" ]; then
          read -r -a EXTRA <<< "$INPUT_EXTRA_ARGS"
          ARGS+=("${EXTRA[@]}")
        fi

        cloud-audit scan "${ARGS[@]}"
        EXIT_CODE=$?

        echo "exit-code=$EXIT_CODE" >> "$GITHUB_OUTPUT"

        # Exit code 2 = scan error (always fail)
        if [ $EXIT_CODE -eq 2 ]; then
          echo "::error::cloud-audit scan failed with errors"
          exit 2
        fi

        # Exit code 1 = findings detected
        if [ $EXIT_CODE -eq 1 ]; then
          if [ "$INPUT_FAIL_ON_FINDINGS" != "true" ]; then
            echo "::warning::Security findings detected - see results for details"
            exit 0
          fi
          exit 1
        fi

        exit 0

    - name: Run cloud-audit diff
      if: inputs.diff-baseline != ''
      id: diff
      shell: bash
      env:
        INPUT_FORMAT: ${{ inputs.format }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_REGIONS: ${{ inputs.regions }}
        INPUT_DIFF_BASELINE: ${{ inputs.diff-baseline }}
      run: |
        set +e

        # For diff, we need a JSON scan. Re-run if the primary format was not JSON.
        CURRENT_JSON="$INPUT_OUTPUT"
        if [ "$INPUT_FORMAT" != "json" ]; then
          CURRENT_JSON="current-scan.json"
          DIFF_ARGS=(--provider aws --format json --output "$CURRENT_JSON")
          if [ -n "$INPUT_REGIONS" ]; then
            DIFF_ARGS+=(--regions "$INPUT_REGIONS")
          fi
          cloud-audit scan "${DIFF_ARGS[@]}" || true
        fi

        cloud-audit diff "$INPUT_DIFF_BASELINE" "$CURRENT_JSON"
        EXIT_CODE=$?

        echo "diff-exit-code=$EXIT_CODE" >> "$GITHUB_OUTPUT"

        if [ $EXIT_CODE -eq 1 ]; then
          echo "::warning::New security findings detected compared to baseline"
        fi

    - name: Upload SARIF to GitHub Security tab
      if: inputs.format == 'sarif' && always()
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: ${{ inputs.output }}
        wait-for-processing: true