heretek-actions/.github/workflows/ocr-scan.yml

name: "OCR Full Codebase Scan"
on:
  workflow_dispatch:
    inputs:
      scan-path:
        description: "Path to scan (default: entire repository)"
        type: string
        default: "."
        required: false
      ocr-llm-model:
        description: "LLM model override"
        type: string
        required: false
        default: ""
  workflow_call:
    secrets:
      ocr-llm-url:
        description: "LLM API endpoint URL (e.g. https://api.anthropic.com/v1/messages)"
        required: true
      ocr-llm-token:
        description: "LLM API authentication token"
        required: true
      github-token:
        description: "GitHub token"
        required: false
    inputs:
      scan-path:
        description: "Path to scan (default: entire repository)"
        type: string
        required: false
        default: "."
      ocr-llm-model:
        description: "LLM model override"
        type: string
        required: false
        default: ""
      ocr-use-anthropic:
        description: "Set to true for Anthropic protocol, false for OpenAI"
        type: string
        required: false
        default: "true"

permissions:
  contents: read
  issues: write

jobs:
  ocr-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4
        with:
          fetch-depth: "0"

      - name: "Install Open Code Review CLI"
        shell: bash
        run: |
          # Install OCR CLI for scan mode
          # The alibaba/open-code-review action is for PR reviews;
          # for full scans we use the CLI directly
          curl -fsSL https://open-codereview.ai/install.sh | bash 2>/dev/null || \
          npm install -g @open-code-review/cli 2>/dev/null || \
          npx @open-code-review/cli --version 2>/dev/null || true
          ocr --version 2>/dev/null || echo "OCR CLI installed"

      - name: "Run OCR Scan"
        id: scan
        shell: bash
        env:
          OCR_LLM_URL: ${{ secrets.ocr-llm-url }}
          OCR_LLM_TOKEN: ${{ secrets.ocr-llm-token }}
          OCR_LLM_MODEL: ${{ inputs.ocr-llm-model || vars.OCR_LLM_MODEL || 'claude-sonnet-4-20250514' }}
          OCR_USE_ANTHROPIC: ${{ inputs.ocr-use-anthropic || vars.OCR_LLM_USE_ANTHROPIC || 'true' }}
          SCAN_PATH: ${{ inputs.scan-path || github.event.inputs.scan-path || '.' }}
        run: |
          mkdir -p .ocr

          # Run full repo scan
          echo "🔍 Scanning: ${SCAN_PATH}"
          if command -v ocr &>/dev/null; then
            ocr scan --path "${SCAN_PATH}" --format json --audience agent 2>&1 | tee .ocr/scan-output.txt
          else
            echo "OCR CLI not found, attempting npx..."
            npx @open-code-review/cli scan --path "${SCAN_PATH}" --format json 2>&1 | tee .ocr/scan-output.txt
          fi

          # Check for result.json output (OCR writes here)
          if [ -f ".ocr/result.json" ]; then
            echo "OCR results saved to .ocr/result.json"
          elif [ -f ".ocr/report.json" ]; then
            echo "OCR results saved to .ocr/report.json"
          else
            # Try to extract from stdout
            tail -c 100000 .ocr/scan-output.txt | grep -oP '\{.*\}' | head -1 > .ocr/result.json 2>/dev/null || true
          fi

      - name: "Build Agent Envelope"
        uses: Heretek-AI/heretek-actions/.github/actions/ocr-envelope@v1
        with:
          ocr-command: scan
          ocr-result-file: .ocr/result.json
          github-token: ${{ secrets.github-token || secrets.GITHUB_TOKEN }}

      - name: "Upload Agent Output"
        uses: actions/upload-artifact@v4
        with:
          name: agent-output-ocr-scan
          path: |
            .agent/output.json
            .ocr/
          if-no-files-found: warn
          retention-days: 30

      - name: "Create Issues from Findings (opt-in)"
        if: false  # Disabled by default — enable by changing to 'if: true'
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.github-token || secrets.GITHUB_TOKEN }}
        run: |
          if [ -f .agent/output.json ]; then
            FINDINGS=$(cat .agent/output.json | jq -c '.findings[] | select(.severity == "error")')
            echo "$FINDINGS" | while IFS= read -r finding; do
              FILE=$(echo "$finding" | jq -r '.file // "unknown"')
              MESSAGE=$(echo "$finding" | jq -r '.message // ""')
              RULE=$(echo "$finding" | jq -r '.rule // "ocr-finding"')
              TITLE="[OCR] ${RULE}: ${MESSAGE:0:80}"
              BODY="**File:** \`${FILE}\`\n\n**Finding:** ${MESSAGE}\n\n_Generated by Open Code Review full scan_"

              gh issue create \
                --title "$TITLE" \
                --body "$BODY" \
                --label "ocr,automated" \
                2>/dev/null || true
            done
          fi

      - name: "Summarize"
        shell: bash
        run: |
          if [ -f .agent/output.json ]; then
            echo "## OCR Full Scan Results" >> $GITHUB_STEP_SUMMARY
            cat .agent/output.json | jq -r '. | "- **Status**: \(.status)\n- **Summary**: \(.summary)"' >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY

            FINDINGS_COUNT=$(cat .agent/output.json | jq '.findings | length' 2>/dev/null || echo 0)
            echo "**Total findings: ${FINDINGS_COUNT}**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY

            if [ "$FINDINGS_COUNT" -gt 0 ] && [ "$FINDINGS_COUNT" -le 30 ]; then
              echo "| Severity | Rule | File |" >> $GITHUB_STEP_SUMMARY
              echo "|----------|------|------|" >> $GITHUB_STEP_SUMMARY
              cat .agent/output.json | jq -r '.findings[] | "| \(.severity) | \(.rule) | `\(.file)` |"' >> $GITHUB_STEP_SUMMARY
            fi
          fi