fix: add debug logging and fix bandit multi-target separator (#36)

* fix: add debug logging and fix bandit multi-target separator

* fix: handle empty RUNNER_DEBUG env var in bool validator

Author: lhoupert

action.yml

@@ -33,6 +33,9 @@ inputs:
   artifact_name:
     description: Name of the artifact uploaded by the action
     default: security-audit-reports
+  debug:
+    description: Enable debug logging for the Python audit module
+    default: 'false'
 
 runs:
   using: composite
@@ -52,7 +55,7 @@ runs:
           IFS=',' read -ra parts <<< "$BANDIT_SCAN_DIRS"
           for part in "${parts[@]}"; do
             [[ "$part" == "." ]] && t="$WORKING_DIRECTORY" || t="$WORKING_DIRECTORY/$part"
-            resolved="${resolved:+$resolved,}$t"
+            resolved="${resolved:+$resolved }$t"
           done
           echo "targets=$resolved" >> "$GITHUB_OUTPUT"
         fi
@@ -84,6 +87,8 @@ runs:
         POST_PR_COMMENT: ${{ inputs.post_pr_comment }}
         GITHUB_TOKEN: ${{ inputs.github_token }}
         PR_NUMBER: ${{ github.event.pull_request.number }}
+        INPUT_DEBUG: ${{ inputs.debug }}
+        RUNNER_DEBUG: ${{ runner.debug }}
       run: uv run --no-project --with "${{ github.action_path }}" python -m python_security_auditing
 
     - name: Upload ${{ inputs.artifact_name }}

src/python_security_auditing/__main__.py

@@ -15,15 +15,35 @@
 def main() -> None:
     settings = Settings()
 
+    if settings.debug:
+        print(f"[debug] settings: {settings.model_dump()}", file=sys.stderr)
+
     bandit_report: dict[str, Any] = {}
     pip_audit_report: list[dict[str, Any]] = []
 
     if "bandit" in settings.enabled_tools:
+        if settings.debug:
+            print(
+                f"[debug] reading bandit SARIF from {settings.bandit_sarif_path}", file=sys.stderr
+            )
         bandit_report = read_bandit_sarif(Path(settings.bandit_sarif_path))
+        if settings.debug:
+            print(
+                f"[debug] bandit findings: {len(bandit_report.get('results', []))}", file=sys.stderr
+            )
 
     if "pip-audit" in settings.enabled_tools:
+        if settings.debug:
+            print(
+                f"[debug] generating requirements for package_manager={settings.package_manager}",
+                file=sys.stderr,
+            )
         requirements_path = generate_requirements(settings)
-        pip_audit_report = run_pip_audit(requirements_path)
+        if settings.debug:
+            print(f"[debug] running pip-audit on {requirements_path}", file=sys.stderr)
+        pip_audit_report = run_pip_audit(requirements_path, settings)
+        if settings.debug:
+            print(f"[debug] pip-audit findings: {len(pip_audit_report)}", file=sys.stderr)
 
     markdown = build_markdown(bandit_report, pip_audit_report, settings)
     write_step_summary(markdown, settings)

src/python_security_auditing/runners.py

@@ -29,15 +29,25 @@ def generate_requirements(settings: Settings) -> Path:
     out_path = Path(tmp.name)
 
     if pm == "uv":
+        cmd = ["uv", "export", "--format", "requirements-txt", "--no-hashes", "-o", str(out_path)]
+        if settings.debug:
+            print(f"[debug] uv export command: {cmd}", file=sys.stderr)
         subprocess.run(
-            ["uv", "export", "--format", "requirements-txt", "--no-hashes", "-o", str(out_path)],
+            cmd,
             check=True,
             capture_output=True,
             text=True,
         )
+        if settings.debug:
+            print(
+                f"[debug] generated requirements ({out_path}):\n{out_path.read_text()}",
+                file=sys.stderr,
+            )
     elif pm == "pip":
         result = subprocess.run(["pip", "freeze"], capture_output=True, text=True, check=True)
         out_path.write_text(result.stdout)
+        if settings.debug:
+            print(f"[debug] pip freeze output ({out_path}):\n{result.stdout}", file=sys.stderr)
     elif pm == "poetry":
         subprocess.run(
             ["poetry", "self", "add", "poetry-plugin-export"],
@@ -59,11 +69,21 @@ def generate_requirements(settings: Settings) -> Path:
             capture_output=True,
             text=True,
         )
+        if settings.debug:
+            print(
+                f"[debug] poetry export output ({out_path}):\n{out_path.read_text()}",
+                file=sys.stderr,
+            )
     elif pm == "pipenv":
         result = subprocess.run(
             ["pipenv", "requirements"], capture_output=True, text=True, check=True
         )
         out_path.write_text(result.stdout)
+        if settings.debug:
+            print(
+                f"[debug] pipenv requirements output ({out_path}):\n{result.stdout}",
+                file=sys.stderr,
+            )
 
     return out_path
 
@@ -110,11 +130,16 @@ def read_bandit_sarif(sarif_path: Path) -> dict[str, Any]:
     return {"results": results, "errors": []}
 
 
-def run_pip_audit(requirements_path: Path) -> list[dict[str, Any]]:
+def run_pip_audit(
+    requirements_path: Path, settings: Settings | None = None
+) -> list[dict[str, Any]]:
     """Run pip-audit, write pip-audit-report.json, return parsed report."""
     output_file = Path("pip-audit-report.json")
     cmd = ["pip-audit", "-r", str(requirements_path), "-f", "json"]
 
+    if settings and settings.debug:
+        print(f"[debug] pip-audit command: {cmd}", file=sys.stderr)
+
     result = subprocess.run(cmd, capture_output=True, text=True)
     # pip-audit exits 1 when vulnerabilities are found — that is expected
     if result.returncode not in (0, 1):
@@ -123,6 +148,13 @@ def run_pip_audit(requirements_path: Path) -> list[dict[str, Any]]:
             file=sys.stderr,
         )
 
+    if settings and settings.debug:
+        print(
+            f"[debug] pip-audit exit={result.returncode} "
+            f"stdout_len={len(result.stdout)} stderr={result.stderr!r}",
+            file=sys.stderr,
+        )
+
     raw = result.stdout.strip()
     if raw:
         parsed: Any = json.loads(raw)

src/python_security_auditing/settings.py

@@ -13,6 +13,22 @@ class Settings(BaseSettings):
 
     model_config = SettingsConfigDict(case_sensitive=False)
 
+    # Debug mode — enabled via INPUT_DEBUG=true or RUNNER_DEBUG=1 (GitHub re-run with debug logging)
+    input_debug: bool = False
+    runner_debug: bool = False
+
+    @field_validator("runner_debug", mode="before")
+    @classmethod
+    def _runner_debug_from_int(cls, v: object) -> object:
+        # GitHub sets RUNNER_DEBUG="1" when enabled; it may also be "" when not set
+        if v == "" or v == "0":
+            return False
+        return v
+
+    @property
+    def debug(self) -> bool:
+        return self.input_debug or self.runner_debug
+
     # Tool selection
     tools: str = "bandit,pip-audit"