Add deployment summary to the job summary and pull request comment

[chhateauuu]

Summary

When sql-action deploys a database, the details of what actually changed are only visible in the build logs. A reviewer sees a green check and has to open the run and read the logs to learn what happened to the database.

This PR makes the action publish a concise deployment summary of what the deployment changed. It is written to the GitHub Actions job summary and, on pull requests, posted as a single auto-updating sticky comment. It reports the objects created, altered, and dropped, warns about possible data loss, and includes the full deployment T-SQL in a collapsible section.

The information already exists: SqlPackage computes the change set during every publish. This PR captures the deployment report and script it produces, parses them, formats a summary, and publishes it. No deployment logic is added or changed.

code-walkthrough.md

What it looks like

On a pull request that changes the schema, the action posts a summary like this:

SQL deployment summary

Published Database.sqlproj to myserver / mydb — 10 changes (5 created, 4 altered, 1 dropped), 3 data-loss warnings

A metadata table (action, target, duration, triggering user, commit, options), followed by:

Changes (10)

By-type and by-schema breakdowns, then collapsible Created / Altered / Dropped sections listing each object and its type.

Possible data loss (3)

• The column [dbo].[Messages].[LegacyFlag] is being dropped, data loss could occur.
• The table [dbo].[OldAudit] is being dropped, data loss could occur.

A collapsible block with the full deployment T-SQL script.

What changed

• New src/DeploymentReport.ts: parses the SqlPackage deployment report XML into operations and alerts. Tolerant of missing or malformed input.
• New src/DeploymentSummary.ts: a pure function that renders the summary Markdown.
• New src/Reporter.ts: writes the job summary, posts or updates the sticky PR comment, and sets outputs. Best-effort; it can never fail a deployment.
• src/AzureSqlAction.ts: during a Publish, captures the deployment report and script (respecting any caller-supplied paths) and returns their locations.
• src/main.ts: measures the deploy duration and invokes the reporter after a successful deploy.
• action.yml and README.md: document the new inputs and outputs.

The change is organized into small, logical commits so it can be reviewed step by step.

New inputs (all optional)

Input	Default	Description
summary	true	Write the deployment summary to the job summary.
comment-pr	auto	Post the summary as a sticky PR comment. One of off, auto, always.
github-token	${{ github.token }}	Token used to post the comment.

New outputs

changes-detected, objects-changed, deployment-report-path, deployment-script-path.

Behavior and safety

• Backward compatible. No existing input, output, or deploy behavior changes. Existing workflows run identically with no edits.
• Reporting is fully guarded. Any error is logged as a warning; the deployment result is never affected.
• No secrets. The target is shown as server and database only; user id and password are already masked and never appear in the summary.
• The comment requires pull-requests: write. When the token or permission is missing, the action logs a warning and falls back to the job summary.
• Object rows and the script are truncated with a clear marker so a comment cannot become excessively large; table cells escape pipe characters.

Compatibility notes

• Two dependencies were added: fast-xml-parser (report parsing) and @actions/github (comment posting). @actions/github is pinned to the v6 CommonJS line for compatibility with the existing webpack build.
• The committed lib/main.js grows from about 284 KB to 860 KB, driven mainly by the GitHub API client.
• Open question: comment-pr defaults to auto. If a more conservative default is preferred, it can default to off (opt-in). This is a one-line change; happy to adjust.

Testing

• New Jest suites cover the parser (real sample report plus single-node, empty, blank, and malformed input), the renderer (grouping, counts, breakdowns, data-loss, truncation, pipe escaping, byte-order-mark handling, and a check that no password is rendered), the reporter (comment created when absent, updated when present, warn-without-fail on missing token, non-PR, or permission errors), and the capture argument injection.
• Full suite green at 177 tests; npm run build succeeds and the committed bundle is up to date.