Feat (Phase 4): Add GitHub Action, GitLab CI template, and VS Code task

.vscode/tasks.json

@@ -0,0 +1,16 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "CommitGuard: Scan Staged Changes",
+            "type": "shell",
+            "command": "commitguard scan --staged --format text",
+            "problemMatcher": [],
+            "presentation": {
+                "reveal": "always",
+                "panel": "new"
+            },
+            "group": "test"
+        }
+    ]
+}

action.yml

@@ -0,0 +1,34 @@
+name: "CommitGuard Scan"
+description: "AI-paced vulnerability scanning for code commits."
+inputs:
+  model:
+    description: "The Hugging Face model ID or path to use for scanning"
+    required: false
+    default: "inmodel-labs/commitguard-llama-3b"
+  fail-on-vulnerable:
+    description: "Fail the workflow if a vulnerability is found (true/false)"
+    required: false
+    default: "true"
+  github_token:
+    description: "GitHub token for PR scanning"
+    required: false
+    default: ${{ github.token }}
+runs:
+  using: "docker"
+  image: "Dockerfile.serve"
+  args:
+    - "bash"
+    - "-c"
+    - |
+      pip install -e .
+      FAIL_ARG=""
+      if [ "${{ inputs.fail-on-vulnerable }}" = "true" ]; then
+        FAIL_ARG="--fail-on-vulnerable"
+      fi
+      # In a PR context, scan the PR diff. Otherwise, scan HEAD.
+      if [ "${{ github.event_name }}" = "pull_request" ]; then
+        # Needs gh cli or fetching diff manually. For simplicity, scan the latest commit.
+        commitguard scan --commit HEAD --format text $FAIL_ARG --model ${{ inputs.model }}
+      else
+        commitguard scan --commit HEAD --format text $FAIL_ARG --model ${{ inputs.model }}
+      fi

gitlab-ci-template.yml

@@ -0,0 +1,16 @@
+.commitguard-scan:
+  image: python:3.12-slim
+  stage: test
+  variables:
+    COMMITGUARD_MODEL: "inmodel-labs/commitguard-llama-3b"
+    FAIL_ON_VULNERABLE: "true"
+  before_script:
+    - apt-get update && apt-get install -y git
+    - pip install commitguard  # Assuming published to PyPI, or pip install git+...
+  script:
+    - |
+      FAIL_ARG=""
+      if [ "$FAIL_ON_VULNERABLE" = "true" ]; then
+        FAIL_ARG="--fail-on-vulnerable"
+      fi
+      commitguard scan --commit HEAD --format text $FAIL_ARG --model $COMMITGUARD_MODEL