action.yaml

name: 'lacework-code-security'
description: "Scan code with Lacework's Code Security offering"
author: 'Lacework'
inputs:
  sources:
    description: 'Sources directory to analyze'
    required: false
    default: '.'
  target:
    description: 'One of push, old or new to represent which is being analyzed'
    required: false
  token:
    description: 'Set to a GitHub token for the repository with write permissions for PRs to enable PR comments'
    required: false
  footer:
    description: 'A block of Markdown that will be appended to any PR comments posted'
    required: false
  code-scanning-path:
    description: 'Path to write code scanning SARIF file'
    required: false
    default: 'code-scanning.sarif'
outputs:
  old-completed:
    description: 'If running a target called old, whether the analysis for this was completed'
    value: ${{ steps.run-analysis.outputs.old-completed }}
  new-completed:
    description: 'If running a target called new, whether the analysis for this was completed'
    value: ${{ steps.run-analysis.outputs.new-completed }}
  push-completed:
    description: 'If running a target called push, whether the analysis for this was completed'
    value: ${{ steps.run-analysis.outputs.push-completed }}
  display-completed:
    description: 'If displaying results, whether this was completed'
    value: ${{ steps.run-analysis.outputs.display-completed }}
  comment-posted:
    description: 'If a comment was posted, a link to this comment'
    value: ${{ steps.run-analysis.outputs.comment-posted }}
runs:
  using: 'composite'
  steps:
    - shell: bash
      run: echo "LACEWORK_START_TIME=$(date --rfc-3339=seconds)" >> $GITHUB_ENV
    - id: init
      shell: bash
      env:
        LACEWORK_ACTION_REF: '${{ github.action_ref }}'
      run: |
        LACEWORK_CONTEXT_ID=`echo $RANDOM | md5sum | head -c 32`
        echo "Lacework context ID: $LACEWORK_CONTEXT_ID"
        echo "LACEWORK_CONTEXT_ID=$(echo $LACEWORK_CONTEXT_ID)" >> $GITHUB_ENV
        echo "LACEWORK_ACTION_REF=$(echo $LACEWORK_ACTION_REF)" >> $GITHUB_ENV
    - name: Set Lacework account environment variable
      shell: bash
      run: |
        if [ -n "$LW_ACCOUNT_NAME" ]; then
          echo "LW_ACCOUNT=$LW_ACCOUNT_NAME" >> $GITHUB_ENV
        fi
    - uses: actions/setup-node@v6
      with:
        node-version: 24
    - shell: bash
      run: |
        rm -rf ../lacework-code-security
        cp -r "${{ github.action_path }}" ../lacework-code-security
        cd ../lacework-code-security
        HUSKY=0 npm install
        npm run compile
        yq -i -o yaml 'del(.runs.steps) | del(.outputs) | .runs.using="node24" | .runs.main="dist/src/index.js"' action.yaml
    - id: run-analysis
      uses: './../lacework-code-security'
      with:
        sources: '${{ inputs.sources }}'
        target: '${{ inputs.target }}'
        token: '${{ inputs.token || github.token }}'
        footer: '${{ inputs.footer }}'
        code-scanning-path: '${{ inputs.code-scanning-path }}'