action.yml

name: Shopify Scope Guard
description: Review Shopify app access scopes against supported code evidence in CI.
author: RexCode Digital Ltd (Efe Gökdemir)
branding:
  icon: shield
  color: green
inputs:
  path: { description: Repository path to scan, required: false, default: '.' }
  config: { description: Shopify app TOML path, required: false }
  api-version: { description: Admin GraphQL API version selected for scope evidence, required: false, default: '2026-10' }
  fail-on: { description: Minimum finding severity that fails the job, required: false, default: high }
  format: { description: 'Output format: human, json, or sarif', required: false, default: human }
  show-unmapped: { description: Include unsupported Shopify patterns, required: false, default: false }
outputs:
  outcome: { description: Scan outcome }
  finding-count: { description: Total findings }
  high-count: { description: High findings }
  medium-count: { description: Medium findings }
  low-count: { description: Low findings }
  unknown-count: { description: Unknown code patterns }
  api-version: { description: Selected Admin GraphQL API version }
  api-version-status: { description: 'Shopify API version status: stable, release-candidate, unstable, or unverified' }
  evidence-version: { description: Bundled evidence version }
  evidence-applicable: { description: Whether the evidence pack applies to the selected Admin GraphQL API version }
  missing-scope-count: { description: Missing or optional-required scope findings }
  redundant-scope-count: { description: Redundant scope findings }
  webhook-evidenced-count: { description: Classic webhook topics with a required scope evidenced in app configuration }
  webhook-not-evidenced-count: { description: Mapped classic webhook topics whose required scopes are missing or optional only }
  webhook-unknown-count: { description: Classic webhook topics or API versions outside the offline evidence registry }
  report: { description: JSON report path }
runs:
  using: node24
  main: dist/index.cjs