[MAINT] Github Actions Reunification - `sansec-ecomscan`

[damienwebdev]

Action: sansec-ecomscan (new)

Status: 🔴 Convert workflow → action
Source: .github/workflows/sansec-ecomscan.yml (mage-os-only)
Target: sansec-ecomscan/action.yml + .github/workflows/sansec-ecomscan.yml (thin caller)

---

What the workflow currently does

1. Checks out the repo (actions/checkout@v5, persist-credentials: false, PR head SHA)
2. Downloads the ecomscan binary from https://ecomscan.com/downloads/linux-amd64/ecomscan
3. chmod +x ecomscan
4. Runs ./ecomscan --no-auto-update --skip-database --deep --format=csv . with ECOMSCAN_KEY env var
5. Fails (exit 1) if any output is produced

---

Dependents

No external repos call this workflow (per dependents.md). It is only used internally by mage-os/github-actions itself. This makes the conversion low risk.

---

Design decisions

• Checkout stays in the caller workflow — consistent with the pattern used by other actions in this repo (setup-magento, coding-standard post-refactor, etc.)
• License key passed as an input — composite actions cannot read secrets directly; callers must pass the value explicitly
• persist-credentials: false and ref handling — these checkout options are caller concerns and stay in the workflow
• pull_request_target trigger and the push-on-PR skip guard — these are workflow-level concerns and stay in the caller

---

New action: sansec-ecomscan/action.yml

Inputs

Input	Required	Description
ecomscan_key	true	Sansec license key (ECOMSCAN_KEY)

Steps

1. Download ecomscan binary
2. chmod +x ecomscan
3. Run ecomscan, fail on output

---

Updated workflow: .github/workflows/sansec-ecomscan.yml

Becomes a thin caller that handles checkout and trigger logic, then delegates to the action:

on:
  push:
  pull_request_target:
  workflow_dispatch:

jobs:
  run-ecomscan:
    if: github.event.pull_request == null || github.event_name != 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - uses: mage-os/github-actions/sansec-ecomscan@main
        with:
          ecomscan_key: ${{ secrets.SANSEC_LICENSE_KEY }}

---

Implementation steps

1. Create sansec-ecomscan/action.yml as a composite action with the download/chmod/run steps and an ecomscan_key input
2. Update .github/workflows/sansec-ecomscan.yml to the thin caller above
3. Bump actions/checkout from v5 to v6 in the workflow