# ============================================================================
# Invariant-Heavy Action — Demonstrates Multiple Invariants
# ============================================================================
# An action with multiple invariants and an invariant reconciliation actor.
# Create: agents action create --config examples/actions/invariant-heavy.yaml
# ============================================================================

name: local/security-audit
description: "Comprehensive security audit of a project"
long_description: |
  Performs a thorough security audit covering:
  - Dependency vulnerability scanning
  - Static Application Security Testing (SAST)
  - Authentication and authorization review
  - Input validation and injection prevention

strategy_actor: local/security-strategist
execution_actor: local/security-scanner
invariant_actor: local/invariant-resolver

definition_of_done: |
  All critical and high severity findings have been identified.
  A complete security report has been generated with severity
  classifications and remediation steps for each finding.

reusable: true
read_only: false

arguments:
  - name: severity_threshold
    type: string
    required: false
    description: "Minimum severity to include in report"
    default: "low"
    validation_pattern: "^(critical|high|medium|low|informational)$"
  - name: auto_fix
    type: boolean
    required: false
    description: "Automatically create fix plans for critical findings"
    default: false

automation_profile: supervised

invariants:
  - "Never modify production database schemas during audit"
  - "Never execute discovered exploit code against live systems"
  - "All findings must include reproducible steps"
  - "Secrets found during scanning must be redacted in reports"
  - "Remediation fixes must not break existing tests"
