Add opt-in quality gate enforcement to CI scans

README.md

@@ -37,7 +37,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Run CodeAnt CI Scan
-        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
         with:
           access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
 ```
@@ -48,7 +48,7 @@ Customize the scan with additional options:
 
 ```yaml
 - name: Run CodeAnt CI Scan
-  uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+  uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
   with:
     access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
     api_base: 'https://api.codeant.ai'
@@ -58,6 +58,37 @@ Customize the scan with additional options:
     scanners: 'sast,sca,secrets'
 ```
 
+## Block on a failed quality gate
+
+Configure **Full Code** conditions in **CodeAnt → Settings → Code Analysis → Quality Gates**, then enable enforcement:
+
+```yaml
+- name: CodeAnt quality gate
+  uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+  with:
+    access_token: ${{ secrets.CODEANT_TOKEN }}
+    scanners: sast,sca
+    quality_gate: 'true'
+```
+
+Requires the planned `v0.0.6` release (not published yet); `v0.0.5` does not support `quality_gate`. The input defaults to `'false'` so existing scan-only workflows keep their behavior.
+
+A failed backend verdict or results timeout fails the step when enforcement is enabled. Keep downstream deployment jobs dependent on this job, and use `if: always()` when uploading reports:
+
+```yaml
+- name: Save reports
+  if: ${{ always() }}
+  uses: actions/upload-artifact@v4
+  with:
+    name: codeant-results
+    path: |
+      results.json
+      codeant.sarif
+      codeant-qg.xml
+```
+
+Configure conditions before enforcing: no conditions can produce a native PASSED verdict. The native full-code gate supports SAST/SCA/IaC ratings and duplicate-code conditions; secrets are returned as findings but have no full-code gate metric.
+
 ## Inputs
 
 | Input | Description | Required | Default |
@@ -68,6 +99,7 @@ Customize the scan with additional options:
 | `exclude_paths` | Comma-separated paths to exclude from scan | No | `''` (none) |
 | `scan_timeout` | Scan timeout in seconds | No | `300` |
 | `scanners` | Security scanners to run | No | `sast,sca` |
+| `quality_gate` | Fail the step when the configured full-repository gate fails or results time out (`true`/`false`) | No | `false` |
 
 ## Scanner Options
 
@@ -86,15 +118,15 @@ The `scanners` parameter allows you to customize which security scanners run dur
 
 Run all scanners:
 ```yaml
-- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
   with:
     access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
     scanners: 'all'
 ```
 
 Run specific scanners:
 ```yaml
-- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
   with:
     access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
     scanners: 'sast,secrets,iac'
@@ -149,7 +181,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+      - uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
         with:
           access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
 ```
@@ -168,15 +200,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+      - uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
         with:
           access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
 ```
 
 ### Scan Specific Directories
 
 ```yaml
-- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
   with:
     access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
     include_paths: 'src/,backend/'
@@ -188,7 +220,7 @@ jobs:
 Configure a longer timeout for large repositories:
 
 ```yaml
-- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+- uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5
   with:
     access_token: ${{ secrets.ACCESS_TOKEN_GITHUB }}
     scan_timeout: '900'  # 15 minutes (default: 300 seconds / 5 minutes)

action.yml

@@ -29,6 +29,10 @@ inputs:
     description: 'Security scanners to run (sast, sca, secrets, antipatterns, iac, all)'
     required: false
     default: 'sast,sca'
+  quality_gate:
+    description: 'Fail the step when the configured full-repository quality gate fails or results time out'
+    required: false
+    default: 'false'
 
 runs:
   using: 'composite'
@@ -64,6 +68,7 @@ runs:
         EXCLUDE_PATHS: ${{ inputs.exclude_paths }}
         SCAN_TIMEOUT: ${{ inputs.scan_timeout }}
         SCANNERS: ${{ inputs.scanners }}
+        QUALITY_GATE: ${{ inputs.quality_gate }}
       run: |
         bash start_scan.sh \
           -a "$ACCESS_TOKEN" \
@@ -74,4 +79,5 @@ runs:
           -i "$INCLUDE_PATHS" \
           -e "$EXCLUDE_PATHS" \
           -t "$SCAN_TIMEOUT" \
-          --scanners "$SCANNERS"
+          --scanners "$SCANNERS" \
+          --quality-gate "$QUALITY_GATE"