*: convert to single JS action

[thypon]

No description provided.

[diracdeltas]

nit: whitespace at end of line

[diracdeltas]

nice refactor!

[github-actions]

[puLL-Merge] - brave/security-action@582

Description

This PR makes several changes to the security-action GitHub Action to improve its functionality and maintainability. The main motivation for these changes seems to be refactoring the action to use a single JavaScript file (action.cjs) to handle the main logic, rather than using multiple steps in the action.yml file.

Changes

Changes

• .github/workflows/full-loop.yml: Adds set -e to fail the step if any command fails
• .github/workflows/loop.yml: Adds slack_token input
• .github/workflows/semgrep-self-test.yml: Changes directory to assets/semgrep_rules/ before running semgrep --test
• action.cjs (new): Main JavaScript file that handles the core logic of the action. Imports functions from files in src/ to handle different steps.
• action.yml:
  • Refactors to use a single JavaScript file (action.cjs) via actions/github-script rather than multiple steps
  • Simplifies logic for determining when to run reviewdog
  • Removes many individual steps that are now handled in action.cjs
• assets/semgrep_rules/client/licensing7.txt (new): Adds a new Semgrep rule
• package.json: Adds markdown-to-txt dependency
• src/pullRequestChangedFiles.js (new): Function to get changed files in a PR
• src/sendSlackMessage.js:
  • Adds support for text parameter in addition to message
  • Adds support for color parameter to set Slack message color
  • Adds logic to find Slack channel ID from name
  • Adds debouncing of duplicate messages in last 24 hours
• src/steps/assigneeRemoved.js, src/steps/assigneesAfter.js, src/steps/hotwords.js: Minor refactoring

Possible Issues

The debouncing logic in src/sendSlackMessage.js could potentially prevent legitimate duplicate messages from being sent if an issue occurs multiple times in 24 hours. It may be worth adding a way to bypass the debounce in certain cases.

Overall this is a significant refactoring of the action but the changes look reasonable. I would suggest thorough testing, especially around the Slack integration and debouncing, to ensure no unexpected behavior. The maintainability improvements from consolidating the logic into action.cjs are a good change.