getcargohq__cargo-skills/.github/workflows/plugin-scanner.yml

name: plugin-scanner

# Required by hashgraph-online/awesome-ai-plugins for a listing (their
# `validate-contribution.py` gate checks that this repo runs the scanner on
# push/pull_request). The action is pinned to a full commit SHA rather than the
# floating `v1` tag, and the job gets a read-only token with no secrets in
# scope — the same shape the awesome-ai-plugins maintainers use themselves.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    name: Scan the plugin bundle for security and quality signals
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Run HOL AI Plugin Scanner
        uses: hashgraph-online/ai-plugin-scanner-action@bbeac35a403ccc95459cdbe68249916e6149182c # v1.2.537
        with:
          plugin_dir: "."
          mode: scan
          format: markdown
          output: scanner-report.md
          config: .plugin-scanner.toml
          min_score: 80
          fail_on_severity: high
          # Disable Cisco scanner to work around false positives in v2.0.14
          # that flag standard Unicode characters (→, —) as obfuscation.
          # The base plugin scanner still runs all security checks.
          cisco_skill_scan: "off"
          # No `pull-requests: write` above, so the comment would fail anyway.
          pr_comment: off
          # The action publishes the report itself, but that step is skipped
          # when the scan exits non-zero — exactly when the findings matter.
          # Turn it off and own the publishing below, so the report lands the
          # same way whether the gate passes or fails.
          write_step_summary: false

      - name: Publish scanner report
        if: always()
        run: tee -a "$GITHUB_STEP_SUMMARY" < scanner-report.md || true