Expose versioned JSON results from the Policy as Code Action

[Copilot]

Adds structured Policy as Code results for downstream workflow steps and external integrations, while retaining existing workflow summaries.

• Action output

  • Exposes results as JSON through composite Action outputs.
  • Publishes results even when policy enforcement fails.

• Result file

  • Writes JSON to .compliance/results.json by default.
  • Adds an output input and CLI --output option for custom locations.

• Schema

  • Includes a version, total violation count, and enabled-check counts.

- id: policy
  uses: advanced-security/policy-as-code@v2.11.1

- run: echo '${{ fromJSON(steps.policy.outputs.results).total_violations }}'

{
  "schema_version": 1,
  "total_violations": 2,
  "checks": {
    "code_scanning": 1,
    "dependabot": 1
  }
}

• Documentation and coverage
  • Documents the output contract and downstream usage.
  • Adds focused JSON serialization coverage.

• Fixes Option for structured ouput #68

[Copilot]

Copilot wasn't able to review any files in this pull request.

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 3
• Review effort level: Lite

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Review details

Suppressed comments (2)

README.md:77

• The example step name says "Advance Security Policy as Code"; this reads like a typo and should be "Advanced Security Policy as Code" for consistency and clarity.

- name: Advance Security Policy as Code

ghascompliance/main.py:249

• errors is incremented both for policy violations and for runtime/authentication exceptions, so writing it as total_violations can make the JSON output misleading (and can diverge from the sum of per-check counts). Consider emitting the sum of per-check violation counts as total_violations.

    write_results(arguments.output, errors, check_results)

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (2)

README.md:67

• The README’s quick-start workflow snippet still uses “Advance Security …” (missing “d”), which can propagate the typo into users’ workflows. Please align it with the project name (“Advanced Security …”).

  uses: advanced-security/policy-as-code@v2.11.1

action.yml:62

• The composite action’s main step invokes python3, but the results step already accounts for environments where only python is available. For better runner portability (notably Windows bash), prefer python with a python3 fallback for running the CLI as well.

        export PYTHONPATH=${{ github.action_path }}:${{ github.action_path }}/vendor
        python3 -m ghascompliance \

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

action.yml:61

• This composite action runs the CLI via python3 -m ghascompliance in the policy step. On some runners (notably Windows with actions/setup-python), python3 may not be available even when python is. Consider invoking the CLI with python so the action consistently uses the configured Python across platforms.

    - id: policy
      shell: bash
      run: |
        echo "Running Policy as Code..."
        export PYTHONPATH=${{ github.action_path }}:${{ github.action_path }}/vendor

• Files reviewed: 5/5 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

action.yml:88

• The results-output step only checks -f before running cat. If the file exists but is unreadable (permissions, transient I/O errors, etc.), cat will exit non-zero and—because GitHub Actions bash runs with -e—this step can fail, preventing the fallback JSON from being emitted. Consider checking readability (-r) and/or falling back when cat fails so the results output is always set.

          if [ -f "$RESULTS_FILE" ]; then
            cat "$RESULTS_FILE"
          else
            printf '%s\n' '{"schema_version":1,"total_violations":null,"total_errors":null,"checks":{},"error":"Results file was not found; the run may have failed before writing results"}'

README.md:70

• The quick-start YAML snippet just above this section still says “Advance Security …” (missing the “d”), while the rest of the README uses “Advanced Security …”. This inconsistency can propagate the typo into users’ workflows.

#### Structured results

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite