Updated workflow

Signed-off-by: r2dedios <alex.ansi.c@gmail.com>

Author: r2dedios

.github/workflows/security-scan.yml

@@ -18,6 +18,10 @@ on:
           - 'true'
           - 'false'
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   security-scan:
     if: github.event.pull_request.draft == false || github.event_name == 'workflow_dispatch'
@@ -29,6 +33,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Resolve PR number
+        id: pr
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -42,20 +55,13 @@ jobs:
       - name: Install skill-scanner
         run: uv pip install --system 'cisco-ai-skill-scanner[google]'
 
-      - name: Make scripts executable
-        run: chmod +x scripts/detect-changed-packs.sh
-
       - name: Detect changed packs
         id: detect
-        env:
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
-          GITHUB_BASE_REF: ${{ github.base_ref }}
-          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.scan_all }}" = "true" ]; then
             PACKS=$(find . -maxdepth 2 -name skills -type d | sed 's|^\./||;s|/skills$||' | sort)
           else
-            PACKS=$(./scripts/detect-changed-packs.sh || true)
+            PACKS=$(bash scripts/detect-changed-packs.sh || true)
           fi
 
           if [ -z "$PACKS" ]; then
@@ -106,41 +112,53 @@ jobs:
           fi
 
       - name: Upload security reports
+        id: upload
         if: steps.detect.outputs.changed == 'true' && always()
         uses: actions/upload-artifact@v4
         with:
           name: security-reports
           path: security-reports/
           retention-days: 30
+          if-no-files-found: ignore
 
       - name: Post scan summary
-        if: steps.detect.outputs.changed == 'true' && github.event_name == 'pull_request' && always()
+        if: steps.detect.outputs.changed == 'true' && always()
         uses: actions/github-script@v7
         with:
           script: |
             const fs = require('fs');
-            const reports = fs.readdirSync('security-reports').filter(f => f.endsWith('.md'));
+            const prNumber = ${{ steps.pr.outputs.number }};
             const scanResult = '${{ steps.scan.outputs.scan_result }}';
             const icon = scanResult === 'passed' ? '✅' : '❌';
 
             let body = `## ${icon} Skill Security Scan\n\n`;
 
-            if (reports.length === 0) {
-              body += 'No reports generated.\n';
-            } else {
-              for (const report of reports) {
-                const pack = report.replace('security-report-', '').replace('.md', '');
-                const content = fs.readFileSync(`security-reports/${report}`, 'utf8');
-                body += `<details>\n<summary>📋 ${pack}</summary>\n\n${content}\n\n</details>\n\n`;
+            if (fs.existsSync('security-reports')) {
+              const reports = fs.readdirSync('security-reports').filter(f => f.endsWith('.md'));
+              if (reports.length === 0) {
+                body += 'No reports generated.\n';
+              } else {
+                for (const report of reports) {
+                  const pack = report.replace('security-report-', '').replace('.md', '');
+                  const content = fs.readFileSync(`security-reports/${report}`, 'utf8');
+                  body += `<details>\n<summary>📋 ${pack}</summary>\n\n${content}\n\n</details>\n\n`;
+                }
               }
+            } else {
+              body += 'No reports generated.\n';
             }
 
-            body += `\n\n> Reports are also available as [workflow artifacts](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}).`;
+            const artifactUrl = '${{ steps.upload.outputs.artifact-url }}';
+            if (artifactUrl) {
+              body += `\n\n> 📦 [Download security reports](${artifactUrl}) | [Workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`;
+            } else {
+              body += `\n\n> [Workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`;
+            }
 
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: context.issue.number,
+              issue_number: prNumber,
             });
 
             const existing = comments.find(c =>
@@ -158,7 +176,7 @@ jobs:
               await github.rest.issues.createComment({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                issue_number: context.issue.number,
+                issue_number: prNumber,
                 body,
               });
             }