feat(UP-0): add main_branch input to diff image scans vs base branch

[amitaboudi]

What

Adds optional main_branch (+ pr_id / pr_link) inputs. When main_branch is set, the action passes --main-branch (etc.) to the shiftleft binary so introduced/resolved CVEs are computed vs the latest scanned image of the base branch instead of the previous commit's image.

- uses: upwindsecurity/shiftleft-create-image-scan-event-action@main
  with:
    ...
    main_branch: ${{ github.event.pull_request.base.ref }}
    pr_id: ${{ github.event.pull_request.number }}

Safe by default

Flags are appended only when the inputs are non-empty (via a bash EXTRA_ARGS array). With no main_branch, nothing changes and the command is unchanged — so this is compatible with shiftleft binaries that predate the flags.

Dependencies / ordering

• Blocked on upwindsecurity/shiftleft#243 (adds --main-branch/--pr-id/--pr-link) being merged and a new binary released before main_branch is actually used. Until then, leaving main_branch unset is a no-op.
• Requires the base branch to have been scanned (e.g. an on: push: [main] workflow) so a baseline image summary exists; otherwise the scan is treated as first-seen (all CVEs introduced).

Verification

• action.yml is valid YAML.
• EXTRA_ARGS logic verified under bash -eo pipefail: empty inputs → no args; set inputs → correct --main-branch=…/--pr-id=….

🤖 Generated with Claude Code