Loop 3: GitHub Action Pro Foundation

[sairintechnologycom]

Goal

Make PkgSafe adoption easier in PR workflows and prepare future paid PR/baseline features without building a hosted PR bot.

Scope

• better PR summary
• changed dependency scan review
• baseline file support or clear unsupported behavior
• fail-on warn/block clarity
• SARIF upload guidance
• Markdown summary improvements
• action output variables and docs alignment
• evidence recorded at evidence/loops/loop-03-github-action-pro-foundation.md

Guardrails

• No hosted PR bot
• Local-first Action behavior
• action.yml inputs match docs
• behavior analysis stays disabled by default
• heuristic behavior is not described as sandboxing or secure containment
• no SaaS, billing, or SSO

[sairintechnologycom]

Loop 3 validation completed on branch loop-03-github-action-pro-foundation.

Evidence: evidence/loops/loop-03-github-action-pro-foundation.md
Sample artifacts:

• evidence/loops/loop-03-results.json
• evidence/loops/loop-03-results.sarif
• evidence/loops/loop-03-summary.md
• evidence/loops/loop-03-results-pass.json
• evidence/loops/loop-03-results-pass.sarif
• evidence/loops/loop-03-summary-pass.md

Summary:

• Added baseline-file support through existing --baseline behavior while preserving Git-ref baseline compatibility.
• Added baseline_type to CI JSON results for successful changed-only scans.
• Improved Markdown PR summaries with workflow result, changed-only state, baseline source/type, counts table, clearer findings, and fail-on-specific guidance.
• Updated GitHub Action docs for baseline-file workflows, fail-on behavior, SARIF permissions, and action output consistency.
• Added tests for baseline-file changed-only scans and Markdown summary context.

Validation passed:

• go test ./internal/ci ./cmd/pkgsafe
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• make package
• baseline-file sample scan with JSON/SARIF/Markdown outputs
• JSON/SARIF parse checks
• action input/output docs consistency checks
• workflow YAML parse check
• targeted wording guardrail check

The --fail-on block sample exited nonzero as expected because the changed dependency scan found a BLOCK. The --fail-on none variant generated the same evidence and exited successfully.

No hosted PR bot, SaaS, billing, SSO, or ecosystem promotion was introduced.