Merge branch 'main' into really-fix-json

Author: egibs

README.md

@@ -1,39 +1,37 @@
 # Malcontent GitHub Action
 
-A GitHub Action that runs [malcontent](https://github.com/chainguard-dev/malcontent) on PR diffs to detect security changes between versions.
+A GitHub Action that runs [malcontent](https://github.com/chainguard-dev/malcontent) on PR diffs to detect security-relevant changes between code versions.
 
 ## Features
 
-- 🔍 **Diff Analysis**: Compares malcontent findings between base and head commits
-- 📊 **Risk Scoring**: Calculates risk scores and detects increases/decreases
-- 💬 **Enhanced PR Comments**: Shows detailed behaviors, not just counts
-- 📝 **Workflow Summary**: Outputs to GitHub Actions summary for non-PR contexts
-- 🎯 **Flexible Modes**: Supports both `diff` and `analyze` modes
-- 📁 **Path Filtering**: Can analyze specific directories with `base-path`
+- 🔍 **Security Diff Analysis**: Compares malcontent findings between base and head commits
+- 📊 **Risk Scoring**: Calculates risk scores and tracks increases/decreases
+- 💬 **Detailed PR Comments**: Shows specific behaviors with risk levels and match examples
+- 📝 **Workflow Summary**: Outputs findings to GitHub Actions summary for non-PR contexts
+- 📁 **Path Filtering**: Analyze specific directories with `base-path`
 - 🚀 **Docker-based**: Uses malcontent Docker image for consistent results
+- 🎯 **Risk-based Actions**: Take different actions based on risk magnitude with `risk-delta` output
 
-## What's New
+## PR Comment Example
 
-### Enhanced PR Comments
-Instead of just showing behavior counts, the action now displays:
-- Up to 10 specific behaviors per file
-- Risk levels with emoji indicators (🔴 CRITICAL, 🟠 HIGH, 🟡 MEDIUM, 🔵 LOW)
-- Example match strings for each behavior
-- Clear risk score changes
+The action provides detailed behavior analysis in PR comments:
 
-Example output:
 ```
-#### 📄 `suspicious-file.js`
-**Risk Score: 35**
+## 🔴 Security Risk Increased (+15 points)
 
-**Behaviors detected:**
-- 🔴 **Potential backdoor** [CRITICAL]
+### Modified Files
+
+#### 📄 `src/app.js`
+
+**➕ Added behaviors:**
+- 🔴 **Potential backdoor detected** [CRITICAL]
   - Match: `eval(atob(`
+  - Rule: [backdoor/js/eval_base64](https://github.com/chainguard-dev/malcontent/blob/main/rules/...)
 - 🟠 **Obfuscated code** [HIGH]
   - Match: `String.fromCharCode(0x68,0x65,0x6c,0x6c,0x6f)`
-- 🟡 **Network communication** [MEDIUM]
-  - Match: `fetch("http://example.com")`
-...and 7 more behaviors
+
+**➖ Removed behaviors:**
+- 🟢 ~~Basic logging~~ [LOW]
 ```
 
 ## Usage
@@ -103,7 +101,9 @@ jobs:
 | `risk-delta` | The change in risk score (positive for increase, negative for decrease) |
 | `report-file` | Path to the full diff report JSON file |
 
-### Example: Using outputs in workflow
+### Using the risk-delta output
+
+The `risk-delta` output allows you to implement custom logic based on the magnitude of security changes:
 
 ```yaml
 - uses: imjasonh/malcontent-action@v1
@@ -125,6 +125,19 @@ jobs:
   run: |
     echo "::error::Significant security risk increase detected!"
     exit 1
+
+# Or use different thresholds for different actions
+- name: Request security review
+  if: steps.malcontent.outputs.risk-delta > 5 && steps.malcontent.outputs.risk-delta <= 10
+  uses: actions/github-script@v6
+  with:
+    script: |
+      github.rest.issues.addLabels({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        labels: ['security-review']
+      })
 ```
 
 ## How It Works
@@ -156,6 +169,20 @@ This will compile the TypeScript/JavaScript code into `dist/index.js` using `@ve
 4. Build: `npm run build`
 5. Commit both source and dist files
 
+### Code Quality
+
+This project uses Prettier for code formatting:
+
+```bash
+# Format code
+npm run format
+
+# Check formatting
+npm run format:check
+```
+
+Pre-commit hooks are configured with Husky to automatically format code before commits.
+
 ## Requirements
 
 - GitHub Actions runner with Docker support (Linux runners)