feat: Implement GitHub Action outputs and golden tests

[pfrederiksen]

Summary

This PR addresses the remaining issues from PR #11 review:

• Issue 3: Fully implement GitHub Action outputs (has-changes, diff-output)
• Issue 4: Add golden tests for new output formats (stat, side-by-side, git-diff)

Changes

GitHub Actions Integration

• Added writeGitHubOutputs() function to write outputs in GitHub Actions format
• Detects GITHUB_OUTPUT environment variable automatically
• Outputs has-changes as boolean (true/false)
• Outputs diff-output using heredoc format for multiline content
• Added comprehensive tests including append behavior verification

Golden Tests

• Converted TestGenerateStat to use golden files (4 test cases)
• Converted TestGenerateSideBySide to use golden files (5 test cases)
• Converted TestGenerateGitDiff to use golden files (5 test cases)
• All golden files generated in testdata/report/
• Tests support -update flag to regenerate golden files

Bug Fixes

• Fixed variable redeclaration error in compareFiles()

Test Results

All tests passing with good coverage:

• cmd/configdiff: 67.7% coverage
• report: 90.9% coverage

Related

Addresses review comments from #11 before merging and releasing v0.3.0.

🤖 Generated with Claude Code

[claude]

Code Review

I found 1 issue that should be addressed:

Heredoc Delimiter Injection Vulnerability in GitHub Actions Output

File: cmd/configdiff/compare.go:283-285

The heredoc format uses a fixed EOF delimiter which creates a potential injection vulnerability. If diffOutput contains a line with just EOF (which is plausible since config files can contain arbitrary string values), the heredoc will terminate prematurely, causing:

1. Output corruption: The rest of the diff content would be interpreted as GitHub Actions workflow commands
2. Output injection: A malicious config file could inject arbitrary outputs affecting subsequent workflow steps

For example, a config file containing:

value: |
  Some text
  EOF
  injected-output=malicious

Recommended fix: Use a randomized delimiter that cannot appear in the content:

delimiter := fmt.Sprintf("ghadelimiter_%d", rand.Int63())
if _, err := fmt.Fprintf(f, "diff-output<<%s\n%s\n%s\n", delimiter, diffOutput, delimiter); err \!= nil {
    return err
}

See GitHub's documentation on multiline strings for more details.

---

Reference:

configdiff/cmd/configdiff/compare.go

Lines 282 to 285 in e8f3784

	// Write diff-output using heredoc format
	if _, err := fmt.Fprintf(f, "diff-output<<EOF\n%s\nEOF\n", diffOutput); err != nil {
	return err
	}