Demonstrate native action quality-gate blocking and reports

.github/workflows/codeant-security.yml

@@ -0,0 +1,45 @@
+name: CodeAnt security pipeline
+
+on:
+  push:
+    branches: [main, examples/security-pipeline]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeant-security-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  security:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Scan repository
+        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
+        with:
+          access_token: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }}
+          scanners: sast,sca,secrets
+          scan_timeout: '1200'
+          quality_gate: 'true'
+      - name: Save reports
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: codeant-results
+          if-no-files-found: error
+          path: |
+            results.json
+            codeant.sarif
+            codeant-qg.xml
+
+  deploy:
+    needs: security
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo 'Replace this step with your deployment command'

examples/security-pipeline/README.md

@@ -0,0 +1,40 @@
+# CI security pipeline
+
+Copy [the workflow](../../.github/workflows/codeant-security.yml), then:
+
+1. Enable secrets, SAST, and SCA analysis in CodeAnt.
+2. Open **Settings → Code Analysis → Quality Gates**, select your repository,
+   and turn **Quality Gate** **On**.
+3. Add **Full Code** conditions for **SAST Security Rating** and **SCA Security
+   Rating**, using **Less Than or Equals → C**. Changes save automatically.
+4. Store a CodeAnt token with the **Codeant CI/CD** role as the Actions secret
+   `CODEANT_TOKEN`. This test repository also accepts its existing legacy secret.
+5. Replace the workflow's branch triggers with your target branch and run it.
+
+Set `quality_gate: 'true'` to fail the action on a failed native verdict or results
+timeout. Set it to `'false'` for report-only runs. The workflow uses
+[v0.0.6](https://github.com/CodeAnt-AI/codeant-ci-scan-action/releases/tag/v0.0.6).
+
+Configure thresholds before enforcing: without conditions, CodeAnt can return
+PASSED. Native full-code gates cover SAST/SCA/IaC ratings and duplicate code.
+Secrets appear in reports but have no native full-code gate metric.
+
+Download **codeant-results** from the run's **Artifacts** section. It contains
+native `results.json`, `codeant.sarif`, and `codeant-qg.xml`. The action does not
+generate CSV/PDF. Reports upload even when the scan step fails.
+
+Replace the deployment placeholder with your command and keep `needs: security`.
+Require the check in branch protection to block merges. Fork PRs are skipped
+because they do not receive repository secrets.
+
+## Verified action runs
+
+These pre-release runs returned 48 findings and a native FAILED verdict (SAST C, SCA D).
+
+| Input | Run | Result |
+| --- | --- | --- |
+| `quality_gate: 'false'` | [42309878084](https://github.com/codeanttesting/codeant-demo/actions/runs/42309878084) | Scan succeeded; deployment placeholder ran. |
+| `quality_gate: 'true'` | [42310207026](https://github.com/codeanttesting/codeant-demo/actions/runs/42310207026) | Scan step failed; deployment was skipped; reports uploaded. |
+
+Native reports and selected logs are preserved in [`evidence/report-only`](evidence/report-only)
+and [`evidence/enforce`](evidence/enforce). Future finding counts may differ.

examples/security-pipeline/evidence/enforce/codeant-qg.xml

@@ -0,0 +1,6 @@
+<?xml version='1.0' encoding='utf-8'?>
+<testsuite name="CodeAnt Quality Gate" tests="2" failures="2"><properties><property name="quality_gate_status" value="FAILED" /><property name="total_findings" value="48" /><property name="sast_rating_full_code" value="C" /><property name="sca_rating_full_code" value="D" /><property name="findings.severity.HIGH" value="19" /><property name="findings.severity.CRITICAL" value="6" /><property name="findings.severity.MEDIUM" value="12" /><property name="findings.severity.LOW" value="11" /><property name="findings.engine.sast" value="9" /><property name="findings.engine.sca" value="38" /><property name="findings.engine.secrets" value="1" /></properties><testcase name="CodeAnt - SAST:sast_rating_full_code"><failure message="sast_rating_full_code is C (same or worse than threshold C)" /></testcase><testcase name="CodeAnt - SCA:sca_rating_full_code"><failure message="sca_rating_full_code is D (same or worse than threshold C)" /></testcase><system-out>Quality Gate: FAILED
+Total findings: 48
+By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11
+By engine: sast=9, sca=38, secrets=1
+Ratings: sast_rating_full_code=C, sca_rating_full_code=D</system-out></testsuite>