mvp

tas-upload-sarif/README.md

@@ -0,0 +1,48 @@
+# TAS Upload SARIF
+
+Reusable GitHub Action that uploads a SARIF report to [TAS (Tea Advanced Security)](https://github.com/go-gitea/gitea) and **fails the job** if the API responds with `allowed: false` (e.g. new findings above your policy).
+
+## Inputs
+
+| Input | Required | Description |
+|-------|----------|-------------|
+| `tas-base-url` | Yes | Base URL of the TAS API (e.g. `https://tas.example.com`) |
+| `sarif-file` | Yes | Path to the SARIF report file (JSON) |
+| `owner` | No | Repository owner (default: `github.repository_owner`) |
+| `repo` | No | Repository name (default: `github.event.repository.name`) |
+| `branch` | No | Branch name (default: `github.ref_name`) |
+
+## Usage
+
+```yaml
+- name: Upload SARIF to TAS and gate
+  uses: your-org/tas-actions/tas-upload-sarif@v1
+  with:
+    tas-base-url: 'https://tas.example.com'
+    sarif-file: 'results.sarif'
+```
+
+With explicit owner/repo/branch (e.g. for monorepos or custom refs):
+
+```yaml
+- uses: your-org/tas-actions/tas-upload-sarif@v1
+  with:
+    tas-base-url: ${{ vars.TAS_BASE_URL }}
+    sarif-file: 'scan-output.sarif'
+    owner: my-org
+    repo: my-repo
+    branch: ${{ github.head_ref }}
+```
+
+## Behavior
+
+1. **POST**s the SARIF file to `{tas-base-url}/repos/{owner}/{repo}/branches/{branch}/reports`.
+2. On HTTP non-200, the step fails and prints the response body.
+3. On success, reads the JSON response:
+   - If `allowed` is `true`, the step succeeds.
+   - If `allowed` is `false`, the step **fails** and prints `reason` and the full response (e.g. `new_critical`, `new_high`, `new_findings`).
+
+## Requirements
+
+- **GitHub-hosted runners**: `curl` and `jq` are available by default.
+- **Self-hosted runners**: ensure `curl` and `jq` are installed.

tas-upload-sarif/action.yml

@@ -0,0 +1,66 @@
+name: 'TAS Upload SARIF'
+description: 'Upload a SARIF report to TAS (Tea Advanced Security) and fail the job if gating returns allowed: false'
+inputs:
+  tas-base-url:
+    description: 'Base URL of the TAS API (e.g. https://tas.example.com)'
+    required: true
+  sarif-file:
+    description: 'Path to the SARIF report file (JSON)'
+    required: true
+  owner:
+    description: 'Repository owner (default: GitHub repository owner)'
+    required: false
+  repo:
+    description: 'Repository name (default: GitHub repository name)'
+    required: false
+  branch:
+    description: 'Branch name (default: current ref name, e.g. main)'
+    required: false
+runs:
+  using: 'composite'
+  steps:
+    - name: Upload SARIF to TAS and gate
+      shell: bash
+      env:
+        OWNER: ${{ inputs.owner || github.repository_owner }}
+        REPO: ${{ inputs.repo || github.event.repository.name }}
+        BRANCH: ${{ inputs.branch || github.ref_name }}
+        BASE_URL: ${{ inputs.tas-base-url }}
+        SARIF_FILE: ${{ inputs.sarif-file }}
+      run: |
+        BASE_URL="${BASE_URL%/}"
+        URL="${BASE_URL}/repos/${OWNER}/${REPO}/branches/${BRANCH}/reports"
+        echo "Uploading SARIF to TAS: $URL"
+
+        if [[ ! -f "$SARIF_FILE" ]]; then
+          echo "::error::SARIF file not found: $SARIF_FILE"
+          exit 1
+        fi
+
+        RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "$URL" \
+          -H "Content-Type: application/json" \
+          -d @"$SARIF_FILE")
+
+        HTTP_BODY=$(echo "$RESPONSE" | head -n -1)
+        HTTP_CODE=$(echo "$RESPONSE" | tail -n 1)
+
+        if [[ "$HTTP_CODE" != "200" ]]; then
+          echo "::error::TAS API returned HTTP $HTTP_CODE"
+          echo "$HTTP_BODY" | head -20
+          exit 1
+        fi
+
+        ALLOWED=$(echo "$HTTP_BODY" | jq -r '.allowed')
+        REASON=$(echo "$HTTP_BODY" | jq -r '.reason // empty')
+
+        if [[ "$ALLOWED" != "true" ]]; then
+          echo "::error::TAS gating failed (allowed: false). $REASON"
+          echo "::error::new_critical/new_high/new_medium/new_low are in the API response."
+          echo "$HTTP_BODY" | jq '.'
+          exit 1
+        fi
+
+        echo "TAS gating passed (allowed: true)."
+        if [[ -n "$REASON" ]]; then
+          echo "$REASON"
+        fi