Add opt-in inline PR review comments to Opengrep action (#20)

Post SAST findings as inline review comments on PRs when
pr-comments: 'true' is set (requires pull-requests: write).
Uses gh CLI for API calls with automatic pagination and auth.
Deduplicates across runs via fingerprint markers in HTML comments.
Falls back to a plain PR comment (with update-in-place dedup)
when inline review fails.

Author: picatz

sast/opengrep/README.md

@@ -6,7 +6,7 @@ Differential SAST with [Opengrep](https://opengrep.dev) for pull requests. Scans
 
 ```yaml
 steps:
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   - uses: temporalio/public-actions/sast/opengrep@main
 ```
 
@@ -19,6 +19,7 @@ That's it. On `pull_request` and `merge_group` events, `baseline-sha` is automat
 | `version` | `v1.21.0` | Opengrep version to install |
 | `baseline-sha` | Auto-detected | Base SHA for differential scanning. Override to compare against a specific commit. |
 | `config` | _(empty)_ | Additional rule config (path or URL). Built-in rules always run. |
+| `pr-comments` | `false` | Post findings as inline PR review comments (opt-in, see below). |
 
 ## Outputs
 
@@ -45,6 +46,28 @@ The action writes a GitHub job summary with:
 
 New findings also appear as `::error::` annotations inline on the PR diff.
 
+## PR review comments
+
+Set `pr-comments: 'true'` to post findings as inline review comments directly on the PR diff, similar to Semgrep's managed scans. This requires `pull-requests: write` permission:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: write
+
+steps:
+  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+  - uses: temporalio/public-actions/sast/opengrep@main
+    with:
+      pr-comments: 'true'
+```
+
+Comments are deduplicated across runs using the finding fingerprint — re-running the action on the same PR won't create duplicate comments. Each comment includes suppression guidance. Multi-line findings highlight the full matched range in the diff.
+
+When a finding is fixed, the action strikes through the original comment and attempts to resolve the review thread. Thread resolution requires a GitHub App token or PAT — the default `GITHUB_TOKEN` can update the comment body but cannot resolve threads via GraphQL (`Resource not accessible by integration`).
+
+When a finding's line isn't part of the diff (edge case), the action falls back to a single PR comment with a table of findings and clickable links. This fallback comment is updated in-place on subsequent runs to avoid notification noise.
+
 ## Built-in rules
 
 | Rule | Languages | What it detects |

sast/opengrep/action.yml

@@ -20,6 +20,12 @@ inputs:
       Built-in Temporal rules always run.
     required: false
     default: ''
+  pr-comments:
+    description: >-
+      Post findings as inline PR review comments (requires
+      pull-requests: write permission). Only applies on pull_request events.
+    required: false
+    default: 'false'
 
 outputs:
   new-count:
@@ -190,6 +196,11 @@ runs:
     - name: Report
       id: report
       shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        PR_COMMENTS_ENABLED: ${{ inputs.pr-comments }}
       run: |
         # Ensure files exist even if prior steps were skipped.
         touch "${RUNNER_TEMP}/new-findings.json"

sast/opengrep/rules/deprecated-actions.yml

@@ -20,6 +20,7 @@ rules:
     fix: |
       uses: actions/create-github-app-token@v2
     metadata:
+      source: sast/opengrep/rules/deprecated-actions.yml
       category: security
       references:
         - https://github.com/tibdex/github-app-token

sast/opengrep/rules/gha-permissions.yml

@@ -8,6 +8,8 @@ rules:
       Add a `permissions:` block at the workflow root (applies to all jobs) or
       per job with least privilege (e.g., `contents: read` and only specific
       writes like `pull-requests: write` if needed).
+    metadata:
+      source: sast/opengrep/rules/gha-permissions.yml
     patterns:
       - pattern-inside: |
           jobs:

sast/opengrep/rules/go-zipslip.yml

@@ -13,6 +13,7 @@ rules:
     languages:
       - go
     metadata:
+      source: sast/opengrep/rules/go-zipslip.yml
       cwe:
         - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory
           ('Path Traversal')"