From f246ae5fcd0c4d59dc812d18bbe4f62561717a6f Mon Sep 17 00:00:00 2001
From: Philipp Horstenkamp <philipp@horstenkamp.de>
Date: Sun, 13 Sep 2026 00:41:19 +0200
Subject: [PATCH 1/2] feat: add write-summary option to publish reports to step
 summary

---
 README.md   |  1 +
 action.yaml | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/README.md b/README.md
index 07286d2..2eb5503 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
+| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
 
 ---
 
diff --git a/action.yaml b/action.yaml
index 3386b8c..b93fdf6 100644
--- a/action.yaml
+++ b/action.yaml
@@ -24,6 +24,10 @@ inputs:
     description: Output markdown file for full vulnerability summary
     required: false
     default: cve-summary.md
+  write-summary:
+    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
+    required: false
+    default: 'true'
 
 outputs:
   delta-report:
@@ -184,3 +188,15 @@ runs:
           --output "${{ inputs.output-summary }}" \
           "$primary_sbom" || true
       fi
+
+  - name: Publish Reports to Step Summary
+    shell: bash
+    run: |
+      if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+        if [ -f "${{ inputs.output-delta }}" ]; then
+          cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+        if [ -f "${{ inputs.output-summary }}" ]; then
+          cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+      fi
-- 
2.54.0


From d4fc8d7b1690d849efed564014ec698ce27f8651 Mon Sep 17 00:00:00 2001
From: Philipp Horstenkamp <philipp@horstenkamp.de>
Date: Sun, 13 Sep 2026 00:43:30 +0200
Subject: [PATCH 2/2] docs: shorten usage example in README.md

---
 README.md | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 2eb5503..4715a52 100644
--- a/README.md
+++ b/README.md
@@ -60,18 +60,11 @@ jobs:
           tags: registry.example.com/my-app:git-${{ github.sha }}
 
       - name: Compare Vulnerabilities (Head vs Target)
-        uses: Philipp/cve-differential@main
+        uses: https://git.horstenkamp.eu/Philipp/cve-differential@main
         with:
           head-image: registry.example.com/my-app:git-${{ github.sha }}
           target-image: registry.example.com/my-app:latest
           target-branch: ${{ github.base_ref || 'main' }}
-
-      - name: Publish CVE Delta to Job Summary
-        if: always()
-        run: |
-          if [ -f cve-delta.md ]; then
-            cat cve-delta.md >> "$GITHUB_STEP_SUMMARY"
-          fi
 ```
 
 ---
-- 
2.54.0