name: star365 deploy audit
description: Consent-based, read-only security audit of your deployed site — fails the job on critical findings. https://audit.star365.site
branding: { icon: shield, color: green }
inputs:
  nonce:        { description: "STAR365_NONCE from `star365-audit.sh request`", required: true }
  receipt-key:  { description: "STAR365_RECEIPT_KEY (store as a secret)", required: true }
  fail-on:      { description: "crit | warn | none", default: crit }
  timeout-minutes: { description: "how long to wait for the receipt", default: "25" }
  api:          { description: "API base", default: "https://audit.star365.site" }
runs:
  using: composite
  steps:
    - shell: bash
      env:
        STAR365_NONCE: ${{ inputs.nonce }}
        STAR365_RECEIPT_KEY: ${{ inputs.receipt-key }}
        FAIL_ON: ${{ inputs.fail-on }}
        TIMEOUT_MIN: ${{ inputs.timeout-minutes }}
        STAR365_API: ${{ inputs.api }}
      run: bash "$GITHUB_ACTION_PATH/star365-audit.sh" rescan