feat: expose maintenance checks in GitHub Action input

action.yml

@@ -75,6 +75,10 @@ inputs:
     description: "Run override hygiene checks (OA001-OA008) inline with the scan and surface findings in the same report"
     required: false
     default: "false"
+  check-maintenance:
+    description: "Run maintenance risk checks (DM001) inline with the scan and surface findings in the same report"
+    required: false
+    default: "false"
   overrides:
     description: "Run a dedicated 'cve-lite overrides' audit (OA001-OA008) as a separate step in addition to the scan"
     required: false
@@ -234,6 +238,7 @@ runs:
         INPUT_CDX: ${{ inputs.cdx }}
         INPUT_CA_CERT: ${{ inputs.ca-cert }}
         INPUT_CHECK_OVERRIDES: ${{ inputs.check-overrides }}
+        INPUT_CHECK_MAINTENANCE: ${{ inputs.check-maintenance }}
         INPUT_AUDIT_LOG: ${{ inputs.audit-log }}
         INPUT_REPORT: ${{ inputs.report }}
         INPUT_FIX: ${{ inputs.fix }}
@@ -293,6 +298,10 @@ runs:
           args+=("--check-overrides")
         fi
 
+        if [[ "${INPUT_CHECK_MAINTENANCE}" == "true" ]]; then
+          args+=("--check-maintenance")
+        fi
+
         if [[ -n "${INPUT_AUDIT_LOG}" ]]; then
           args+=("--audit-log" "${INPUT_AUDIT_LOG}")
         fi

tests/github-action.test.ts

@@ -0,0 +1,15 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+describe("GitHub Action contract", () => {
+  it("includes check-maintenance input and wires it to cve-lite command args", () => {
+    const actionDefinition = readFileSync(resolve(process.cwd(), "action.yml"), "utf8");
+    const inputBlock = actionDefinition.indexOf("check-maintenance:");
+    const envBlock = actionDefinition.indexOf("INPUT_CHECK_MAINTENANCE");
+    const argBlock = actionDefinition.indexOf("args+=(\"--check-maintenance\")");
+
+    expect(inputBlock).toBeGreaterThan(-1);
+    expect(envBlock).toBeGreaterThan(-1);
+    expect(argBlock).toBeGreaterThan(-1);
+  });
+});

website/docs/github-action.md

@@ -66,6 +66,7 @@ For usage patterns and complete workflow examples, see [Workflow Integration](./
 | Input | Default | Description | Example |
 |---|---|---|---|
 | `check-overrides` | `false` | Run override hygiene checks (OA001-OA008) inline with the scan | `check-overrides: "true"` |
+| `check-maintenance` | `false` | Run maintenance risk checks (DM001) inline with the scan | `check-maintenance: "true"` |
 | `overrides` | `false` | Run a dedicated override audit as a separate step in addition to the scan | `overrides: "true"` |
 | `overrides-fail-on` | _(none)_ | Exit non-zero when the override audit finds an issue at or above this severity (used with `overrides: true`) | `overrides-fail-on: high` |
 | `check-network` | `false` | Allow the override audit to make registry calls for the OA007 drift check | `check-network: "true"` |