Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ Options:
--config <path> path to debtlens.config.json
--cwd <path> working directory
--no-color disable terminal color
-q, --quiet terminal only: summary counts, no per-finding detail
-q, --quiet terminal only: suppress per-finding detail
```

Examples:
Expand All @@ -130,6 +130,9 @@ debtlens scan --baseline debtlens-baseline.json --fail-on high

# Pull-request scan: only the files this branch changed vs main
debtlens scan --changed origin/main --fail-on high

# Quiet terminal output: hide per-finding detail
debtlens scan --quiet
```

Baseline fingerprints are stable across line shifts, so moving existing code up or down does not resurface already-recorded debt — only genuinely new issues are reported.
Expand Down Expand Up @@ -213,14 +216,15 @@ jobs:
format: sarif
output: debtlens.sarif
thresholds: large-component.maxLines=300
quiet: true
fail-on: high
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: debtlens.sarif
```

Inputs: `target`, `min-severity`, `rules`, `fail-on`, `format`, `output`, `changed`, `baseline`, `config`, `write-baseline`, `thresholds`, `max-files`, `working-directory`. Each maps to the matching `scan` flag. `write-baseline` and `baseline` are mutually exclusive. With `fail-on`, a qualifying issue fails the job (gating the merge); `if: always()` still uploads the SARIF so annotations appear even on a failing run.
Inputs: `target`, `min-severity`, `rules`, `fail-on`, `format`, `output`, `changed`, `baseline`, `config`, `write-baseline`, `thresholds`, `max-files`, `working-directory`, `quiet`. Each maps to the matching `scan` flag. `write-baseline` and `baseline` are mutually exclusive. With `fail-on`, a qualifying issue fails the job (gating the merge); `if: always()` still uploads the SARIF so annotations appear even on a failing run.

## Development

Expand Down
5 changes: 5 additions & 0 deletions action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ inputs:
working-directory:
description: Directory to run the scan from.
default: "."
quiet:
description: Terminal only - suppress per-finding detail.
default: "false"

runs:
using: composite
Expand Down Expand Up @@ -74,6 +77,7 @@ runs:
DL_WRITE_BASELINE: ${{ inputs.write-baseline }}
DL_THRESHOLDS: ${{ inputs.thresholds }}
DL_MAX_FILES: ${{ inputs.max-files }}
DL_QUIET: ${{ inputs.quiet }}
run: |
args=(scan "$DL_TARGET" --min-severity "$DL_MIN_SEVERITY" --format "$DL_FORMAT")
[ -n "$DL_RULES" ] && args+=(--rules "$DL_RULES")
Expand All @@ -89,4 +93,5 @@ runs:
[ -n "$DL_WRITE_BASELINE" ] && args+=(--write-baseline "$DL_WRITE_BASELINE")
[ -n "$DL_THRESHOLDS" ] && args+=(--threshold "$DL_THRESHOLDS")
[ -n "$DL_MAX_FILES" ] && args+=(--max-files "$DL_MAX_FILES")
[ "$DL_QUIET" = "true" ] && args+=(--quiet)
node "$GITHUB_ACTION_PATH/dist/cli/index.js" "${args[@]}"