feat: refactor GitHub Action to use published npm package via npx (#687)

- Remove npm ci and build steps; use npx cve-lite-cli@version instead
- Add version input (default: 1) to pin to latest 1.x release
- Add major version check that warns when a newer major is available

Closes #686

Author: sonukapoor

action.yml

@@ -67,6 +67,10 @@ inputs:
     description: "Path to a PEM CA certificate file for corporate SSL inspection proxies"
     required: false
     default: ""
+  version:
+    description: "CVE Lite CLI version to install (e.g. '1.23.1', '1', 'latest')"
+    required: false
+    default: "1"
 
 runs:
   using: "composite"
@@ -76,15 +80,18 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
 
-    - name: Install CVE Lite CLI dependencies
-      shell: bash
-      working-directory: ${{ github.action_path }}
-      run: npm ci
-
-    - name: Build CVE Lite CLI
+    - name: Check for new major version
       shell: bash
-      working-directory: ${{ github.action_path }}
-      run: npm run build
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+      run: |
+        LATEST=$(npm view cve-lite-cli version 2>/dev/null || echo "")
+        if [[ -z "$LATEST" || "$INPUT_VERSION" == "latest" ]]; then exit 0; fi
+        CURRENT_MAJOR="${INPUT_VERSION%%.*}"
+        LATEST_MAJOR="${LATEST%%.*}"
+        if [[ "$LATEST_MAJOR" -gt "$CURRENT_MAJOR" ]]; then
+          echo "::warning::CVE Lite CLI v${LATEST_MAJOR} is available. You are currently using v${CURRENT_MAJOR}.x. Update the 'version' input in your workflow to upgrade."
+        fi
 
     - name: Resolve action inputs
       id: resolve
@@ -118,7 +125,7 @@ runs:
       shell: bash
       working-directory: ${{ github.workspace }}
       env:
-        ACTION_PATH: ${{ github.action_path }}
+        INPUT_VERSION: ${{ inputs.version }}
         OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
         INPUT_CA_CERT: ${{ inputs.ca-cert }}
       run: |
@@ -128,13 +135,13 @@ runs:
         if [[ -n "${INPUT_CA_CERT}" ]]; then
           sync_args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
-        node "${ACTION_PATH}/dist/index.js" "${sync_args[@]}"
+        npx --yes "cve-lite-cli@${INPUT_VERSION}" "${sync_args[@]}"
 
     - name: Run CVE Lite CLI scan
       shell: bash
       working-directory: ${{ github.workspace }}
       env:
-        ACTION_PATH: ${{ github.action_path }}
+        INPUT_VERSION: ${{ inputs.version }}
         PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
         USE_OFFLINE: ${{ steps.resolve.outputs.use-offline }}
         OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
@@ -195,4 +202,4 @@ runs:
           args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
 
-        node "${ACTION_PATH}/dist/index.js" "${args[@]}"
+        npx --yes "cve-lite-cli@${INPUT_VERSION}" "${args[@]}"