feat: add Dockerized GitHub Action support (#762)

[salehkhattak]

Closes #762

What this PR does

Adds a GitHub Action that lets users run Graphify in CI/CD to automatically map their repositories into knowledge graphs.

Files added

• action/action.yml — dockerized GitHub Action metadata (inputs, outputs, branding)
• action/Dockerfile — Provides a dedicated Docker container environment that installs Graphify dependencies
• action/entrypoint.sh — Entrypoint that handles subfolder parsing and command execution. Auto-committing updated graph directories back to the repository.
• Documentation: Updates README.md with a ## GitHub Action section, complete with workflow examples for:
  Uploading the generated graph folder as a workflow ZIP artifact.
  Auto-committing updated graph directories back to the repository.

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds a Docker-based GitHub Action so Graphify can map a repository in CI, taking subfolders and options inputs and running python -m graphify against the checked-out workspace via entrypoint.sh. Documents the action in the README with a workflow example covering both artifact upload and committing the generated graphify-out/ back to the repo.

Worth a look

• Action inputs are executed through shell eval — action/entrypoint.sh:8 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• entrypoint uses eval with unquoted user inputs enabling command injection — action/entrypoint.sh:8 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• GitHub Action entrypoint allows shell command injection via inputs — action/entrypoint.sh:8 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Unquoted eval of user-controlled inputs enables shell injection — action/entrypoint.sh:8 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Action can run a repository-local graphify module instead of the installed package — action/entrypoint.sh:8 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 30 functions depend on the 30 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 30 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 30 function(s) in the blast radius were not formally verified this run