README.md

@@ -27,6 +27,7 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
+| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
 
 ---
 

action.yaml

@@ -24,6 +24,10 @@ inputs:
     description: Output markdown file for full vulnerability summary
     required: false
     default: cve-summary.md
+  write-summary:
+    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
+    required: false
+    default: 'true'
 
 outputs:
   delta-report:
@@ -184,3 +188,15 @@ runs:
           --output "${{ inputs.output-summary }}" \
           "$primary_sbom" || true
       fi
+
+  - name: Publish Reports to Step Summary
+    shell: bash
+    run: |
+      if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+        if [ -f "${{ inputs.output-delta }}" ]; then
+          cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+        if [ -f "${{ inputs.output-summary }}" ]; then
+          cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+      fi