fix: warn and suppress fail-on exit when fix mode is active in the Action

[sonukapoor]

When a user sets both fail-on and fix: true in the same GitHub Actions workflow, the scan step exits 1 on findings before the fix step runs, preventing fixes from being applied.

What happens

The Action has two separate steps: "Run CVE Lite CLI scan" (always runs) and "Apply security fixes" (runs when fix: true). If fail-on: high is also set, the scan step exits 1 when high findings exist, which set -euo pipefail propagates - aborting the job before the fix step runs.

The fail-on exit suppression added in this PR only applies when --fix and --fail-on are in the same CLI invocation. In the Action they are in separate steps, so suppression does not help.

Current state

The docs warn: "No fail-on - not appropriate in fix mode." This is advisory only. A user who copy-pastes their scan workflow and adds fix: true without removing fail-on will get a silent failure with no actionable error.

Proposed fix

Add a check at the start of the "Apply security fixes" step:

if [[ -n "${INPUT_FAIL_ON}" ]]; then
  echo "::warning::fail-on is set but ignored in fix mode. Remove fail-on from your fix workflow to avoid unexpected job failures."
fi

And suppress the scan step exit code when fix: true is active so the fix step always runs regardless of findings.

[coder-Yash886]

@sonukapoor i looking to work on this

[sonukapoor]

Assigned - happy to have you pick this up, @coder-Yash886.

The fix lives entirely in action.yml. Here is what needs to change in the "Run CVE Lite CLI scan" step:

1. Add INPUT_FIX: ${{ inputs.fix }} to the step's env block so the script can read it.
2. At the top of the script, emit a warning if both are set:

   if [[ "${INPUT_FIX}" == "true" && -n "${INPUT_FAIL_ON}" ]]; then
     echo "::warning::fail-on is set but has no effect in fix mode. Remove fail-on from your fix workflow to avoid unexpected job failures."
   fi

3. When fix: true is active, suppress the scan exit code so the "Apply security fixes" step always runs regardless of findings:

   if [[ "${INPUT_FIX}" == "true" ]]; then
     cve-lite "${args[@]}" || true
   else
     cve-lite "${args[@]}"
   fi

That is the full change - no TypeScript, no test files. Please branch off the latest main and open the PR with Closes #792 in the body when ready.