v1.1.0 - GitHub Action: SARIF upload + Marketplace polish

What's new since v1.0.0

• Automatic SARIF upload to code scanning. New upload-sarif input
  (default true): when format is sarif, the action now runs
  github/codeql-action/upload-sarif itself, so findings show up as native
  annotations on the repo's Security tab and PR diffs with no extra step.
  Requires the calling job to grant security-events: write. Set
  upload-sarif: 'false' to opt out and handle the upload yourself.
• Marketplace-ready polish. Composite action branding (shield icon, red),
  a full inputs/outputs reference table in the README, a runnable usage
  snippet for reading finding-count/results-file in a later step, and
  CI/release/license status badges.
• CI fix. The self-test workflow's SARIF-upload step was failing in this
  repo's own CI because the default GITHUB_TOKEN doesn't carry
  security-events: write here; the self-test now runs with
  upload-sarif: 'false' (documented inline) so it stays green and
  fork-PR-safe, while the README shows real consumers how to grant that
  permission in their own workflows.

Usage

name: MCP security scan
on: [pull_request]

permissions:
  contents: read
  security-events: write   # required for the SARIF upload to code scanning

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Ventrova/sentinel-scan-cli@v1
        with:
          manifest: mcp.json          # path to your MCP tool manifest
          fail-on-severity: high      # high | medium | low | none
          format: sarif               # sarif | markdown | json
          output: sentinel-scan-results.sarif
          upload-sarif: 'true'        # auto-upload to the Security tab when format is sarif

Inputs

Input	Default	Description
manifest	mcp.json	Path to the MCP tool manifest to scan
fail-on-severity	high	Fail the step at this severity or above: high, medium, low, none
format	sarif	Report format: sarif, markdown, or json
output	sentinel-scan-results.sarif	Where to write the report
upload-sarif	true	Auto-upload SARIF to code scanning when format is sarif

Outputs

Output	Description
results-file	Path to the generated report file
finding-count	Total number of findings

No PyPI/npm publish dependency - the action installs the Python package
straight from this repo's own checkout at ${{ github.action_path }}, no
network calls beyond installing actions/setup-python.

Full diff: v1.0.0...v1.1.0