* feat(action): add scope input to opt into full-project scans on PRs
On pull_request events the action scopes the scan to the PR's changed files
(baseline/diff mode), with no way to scan the whole project. A PR that only
adds config/workflow files therefore reports 0 issues even when the project
has obvious problems in untouched files.
Add a 'scope' input: 'changed' (default, unchanged baseline/diff behavior) or
'full'. When full, skip the pr-files and base steps and pass '--diff false' —
the documented full-scan escape hatch, which disables baseline/diff and
overrides any diff value in the project config. The scope value is lowercased
before the bash test so it matches the case-insensitive comparison the GHA
'inputs.scope != full' expressions use.
Co-authored-by: Ray Arayilakath <me@rayhanadev.com>
* style(action): simplify the --diff false comment to plain language
Co-authored-by: Ray Arayilakath <me@rayhanadev.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Enrich the per-scan Sentry run span with the full run/CI/project/outcome
context (scan mode, score, diagnostics by severity/category, top rule,
lint/dead-code state, and in CI the GitHub event, official-action marker,
forwarded action inputs, and the pull-request gate) so usage and CI behavior
are queryable as spans instead of pre-aggregated counters.
Mint a random per-run runId on the Sentry run context (never a tag or metric
dimension) to correlate the spans of a single run; a workspace invocation's
project scans share one id and per-project span attributes disambiguate. The
wide event's wouldBlock/outcome/exitCode mirror the CLI's real fail-on gate
(ciFailure surface, and no gate in score-only mode). The official GitHub
Action forwards its inputs so action configuration is visible in telemetry.
Telemetry stays anonymized — no repo, owner, username, branch, or path is
sent to Sentry — and --no-score / --no-telemetry opts out.
Co-authored-by: Cursor <cursoragent@cursor.com>
The composite Action is versioned independently from the npm packages via
v-prefixed semver tags (vX.Y.Z) plus a floating major (vN), distinct from
the Changesets `<pkg>@X.Y.Z` tags. Documents the bump rules, the signed-tag
gotcha, and the release/floating-major commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the mutable `millionco/react-doctor@main` reference in the GitHub
Actions example with the `@v1` floating release tag, and add a note on
pinning to a full commit SHA for hardened CI (the example grants
`pull-requests: write`). Avoids running whatever `main` points at runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions[bot]