feat: add audit-report input for SARIF report generation

[danielmeppiel]

Summary

Related to microsoft/apm#329

Adds audit-report input and audit-report-path output to the APM action, enabling SARIF audit report generation for GitHub Code Scanning integration.

Changes

action.yml

• New audit-report input: set to true for default path (apm-audit.sarif), or provide a custom file path
• New audit-report-path output: path to the generated SARIF report

src/runner.ts

• New runAuditReport() helper that runs apm audit -f sarif -o <path> after install/unpack
• Called in both install flow and bundle-restore flow
• Uses ignoreReturnCode: true — audit exit codes (1=critical, 2=warning) are informational, not action failures
• Emits core.warning() for critical findings and when APM is unavailable in restore mode

README.md

• Documented new input/output
• Added Code Scanning usage example

Usage

- uses: microsoft/apm-action@v1
  id: apm
  with:
    audit-report: true
- uses: github/codeql-action/upload-sarif@v3
  if: always() && steps.apm.outputs.audit-report-path
  with:
    sarif_file: ${{ steps.apm.outputs.audit-report-path }}
    category: apm-audit

Depends on

Requires apm audit --format sarif --output support in apm-cli (microsoft/apm#330).

Tests

42 tests passing (4 new: default path resolution, custom path, critical findings warning, no-op when empty).

[Copilot]

Pull request overview

Adds an audit-report input to the APM GitHub Action that generates SARIF audit reports via apm audit, with output path exposed for upload to GitHub Code Scanning.

Changes:

• New audit-report input (accepts true or custom path) and audit-report-path output in action.yml
• New runAuditReport() helper in src/runner.ts that runs apm audit -f sarif -o <path> after install/unpack, with graceful handling of exit codes and missing APM
• Documentation and tests for the new feature

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
action.yml	Adds audit-report input and audit-report-path output
src/runner.ts	Adds audit report path resolution and runAuditReport() helper
src/tests/runner.test.ts	4 new tests covering default path, custom path, critical findings, and no-op
dist/index.js	Compiled bundle reflecting source changes
README.md	Documents new input/output with Code Scanning usage example

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.