From f246ae5fcd0c4d59dc812d18bbe4f62561717a6f Mon Sep 17 00:00:00 2001
From: Philipp Horstenkamp <philipp@horstenkamp.de>
Date: Sun, 13 Sep 2026 00:41:19 +0200
Subject: [PATCH] feat: add write-summary option to publish reports to step
 summary

---
 README.md   |  1 +
 action.yaml | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/README.md b/README.md
index 07286d2..2eb5503 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
+| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
 
 ---
 
diff --git a/action.yaml b/action.yaml
index 3386b8c..b93fdf6 100644
--- a/action.yaml
+++ b/action.yaml
@@ -24,6 +24,10 @@ inputs:
     description: Output markdown file for full vulnerability summary
     required: false
     default: cve-summary.md
+  write-summary:
+    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
+    required: false
+    default: 'true'
 
 outputs:
   delta-report:
@@ -184,3 +188,15 @@ runs:
           --output "${{ inputs.output-summary }}" \
           "$primary_sbom" || true
       fi
+
+  - name: Publish Reports to Step Summary
+    shell: bash
+    run: |
+      if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+        if [ -f "${{ inputs.output-delta }}" ]; then
+          cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+        if [ -f "${{ inputs.output-summary }}" ]; then
+          cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+      fi