action.yml

name: 'layout-audit'
description: 'Analyze binary memory layouts to detect padding inefficiencies'
author: 'avifen'

branding:
  icon: 'cpu'
  color: 'orange'

inputs:
  binary:
    description: 'Path to the binary file to analyze'
    required: true
  command:
    description: 'Command to run: inspect, diff, check, or suggest'
    required: false
    default: 'inspect'
  baseline:
    description: 'Path to baseline binary (for diff command)'
    required: false
  config:
    description: 'Path to config file (for check command)'
    required: false
    default: '.layout-audit.yaml'
  filter:
    description: 'Filter structs by name (substring match)'
    required: false
  output:
    description: 'Output format: table, json, or sarif'
    required: false
    default: 'table'
  sort-by:
    description: 'Sort by: name, size, padding, or padding-pct'
    required: false
    default: 'padding'
  top:
    description: 'Show only top N structs'
    required: false
  min-padding:
    description: 'Show only structs with at least N bytes of padding'
    required: false
  min-savings:
    description: 'Show only structs with at least N bytes of potential savings (for suggest command)'
    required: false
  sort-by-savings:
    description: 'Sort suggestions by savings amount (for suggest command)'
    required: false
    default: 'false'
  fail-on-regression:
    description: 'Fail if size or padding increased (for diff command)'
    required: false
    default: 'false'
  version:
    description: 'Version of layout-audit to use'
    required: false
    default: 'latest'

outputs:
  report:
    description: 'The layout-audit output'
    value: ${{ steps.run.outputs.report }}
  sarif-path:
    description: 'Path to SARIF file (when output=sarif)'
    value: ${{ steps.run.outputs.sarif_path }}

runs:
  using: 'composite'
  steps:
    - name: Install layout-audit
      shell: bash
      env:
        INSTALL_VERSION: ${{ inputs.version }}
      run: |
        if [ "$INSTALL_VERSION" = "latest" ]; then
          cargo install layout-audit --locked
        else
          cargo install layout-audit --version "$INSTALL_VERSION" --locked
        fi

    - name: Run layout-audit
      id: run
      shell: bash
      continue-on-error: true
      env:
        INPUT_COMMAND: ${{ inputs.command }}
        INPUT_BINARY: ${{ inputs.binary }}
        INPUT_BASELINE: ${{ inputs.baseline }}
        INPUT_CONFIG: ${{ inputs.config }}
        INPUT_FILTER: ${{ inputs.filter }}
        INPUT_OUTPUT: ${{ inputs.output }}
        INPUT_SORT_BY: ${{ inputs.sort-by }}
        INPUT_TOP: ${{ inputs.top }}
        INPUT_MIN_PADDING: ${{ inputs.min-padding }}
        INPUT_MIN_SAVINGS: ${{ inputs.min-savings }}
        INPUT_SORT_BY_SAVINGS: ${{ inputs.sort-by-savings }}
        INPUT_FAIL_ON_REGRESSION: ${{ inputs.fail-on-regression }}
      run: |
        set +e

        args=()

        case "$INPUT_COMMAND" in
          inspect)
            args+=(inspect "$INPUT_BINARY")
            if [ -n "$INPUT_FILTER" ]; then
              args+=(--filter "$INPUT_FILTER")
            fi
            args+=(--output "$INPUT_OUTPUT")
            args+=(--sort-by "$INPUT_SORT_BY")
            if [ -n "$INPUT_TOP" ]; then
              args+=(--top "$INPUT_TOP")
            fi
            if [ -n "$INPUT_MIN_PADDING" ]; then
              args+=(--min-padding "$INPUT_MIN_PADDING")
            fi
            ;;
          diff)
            if [ -z "$INPUT_BASELINE" ]; then
              echo "Error: baseline input is required for diff command"
              exit 1
            fi
            args+=(diff "$INPUT_BASELINE" "$INPUT_BINARY")
            if [ -n "$INPUT_FILTER" ]; then
              args+=(--filter "$INPUT_FILTER")
            fi
            args+=(--output "$INPUT_OUTPUT")
            if [ "$INPUT_FAIL_ON_REGRESSION" = "true" ]; then
              args+=(--fail-on-regression)
            fi
            ;;
          check)
            args+=(check "$INPUT_BINARY" --config "$INPUT_CONFIG" --output "$INPUT_OUTPUT")
            ;;
          suggest)
            args+=(suggest "$INPUT_BINARY")
            if [ -n "$INPUT_FILTER" ]; then
              args+=(--filter "$INPUT_FILTER")
            fi
            args+=(--output "$INPUT_OUTPUT")
            if [ -n "$INPUT_MIN_SAVINGS" ]; then
              args+=(--min-savings "$INPUT_MIN_SAVINGS")
            fi
            if [ "$INPUT_SORT_BY_SAVINGS" = "true" ]; then
              args+=(--sort-by-savings)
            fi
            ;;
          *)
            echo "Error: unknown command '$INPUT_COMMAND'"
            exit 1
            ;;
        esac

        echo "Running: layout-audit ${args[*]}"
        if [ "$INPUT_OUTPUT" = "sarif" ]; then
          SARIF_FILE="${RUNNER_TEMP:-/tmp}/layout-audit.sarif"
          layout-audit "${args[@]}" > "$SARIF_FILE"
          EXIT_CODE=$?

          cat "$SARIF_FILE"

          DELIMITER="EOF_${RANDOM}_${RANDOM}"
          {
            echo "report<<${DELIMITER}"
            cat "$SARIF_FILE"
            echo "${DELIMITER}"
          } >> "$GITHUB_OUTPUT"
          if [ -s "$SARIF_FILE" ]; then
            echo "sarif_path=$SARIF_FILE" >> "$GITHUB_OUTPUT"
          else
            echo "sarif_path=" >> "$GITHUB_OUTPUT"
          fi
        else
          OUTPUT=$(layout-audit "${args[@]}" 2>&1)
          EXIT_CODE=$?

          echo "$OUTPUT"

          # Set output for use in subsequent steps
          # Use unique delimiter to prevent output smuggling if OUTPUT contains "EOF"
          DELIMITER="EOF_${RANDOM}_${RANDOM}"
          {
            echo "report<<${DELIMITER}"
            echo "$OUTPUT"
            echo "${DELIMITER}"
          } >> "$GITHUB_OUTPUT"
          echo "sarif_path=" >> "$GITHUB_OUTPUT"
        fi

        echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
        exit 0

    - name: Upload SARIF
      if: ${{ steps.run.outputs.sarif_path != '' }}
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ steps.run.outputs.sarif_path }}

    - name: Fail if layout-audit failed
      if: ${{ steps.run.outputs.exit_code != '0' }}
      shell: bash
      run: exit ${{ steps.run.outputs.exit_code }}