From 894aed6a50b6deba38b144c568741fef8801b85c Mon Sep 17 00:00:00 2001
From: galargh <galargh@users.noreply.github.com>
Date: Sun, 9 Aug 2026 10:20:39 +0000
Subject: [PATCH] upgrade@31308095396

---
 .../__tests__/actions/access-summary.test.ts  | 29 ++++++++++++++++++-
 .../actions/shared/describe-access-changes.ts |  4 +++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/scripts/__tests__/actions/access-summary.test.ts b/scripts/__tests__/actions/access-summary.test.ts
index eeace16..3bed0e2 100644
--- a/scripts/__tests__/actions/access-summary.test.ts
+++ b/scripts/__tests__/actions/access-summary.test.ts
@@ -1,7 +1,10 @@
 import 'reflect-metadata'
 
 import assert from 'node:assert'
+import {mkdtempSync, readFileSync, rmSync} from 'node:fs'
+import {join} from 'node:path'
 import {describe, it} from 'node:test'
+import {tmpdir} from 'node:os'
 import {Config} from '../../src/yaml/config.js'
 import {State} from '../../src/terraform/state.js'
 import {
@@ -11,7 +14,8 @@ import {
 import {
   describeAccessChanges,
   describeAccessChangesComment,
-  describeAccessReport
+  describeAccessReport,
+  runDescribeAccessChanges
 } from '../../src/actions/shared/describe-access-changes.js'
 import {StateSchema} from '../../src/terraform/schema.js'
 
@@ -235,4 +239,27 @@ members:
       'Access changes are too long to post as a comment. Please inspect [the Fix workflow summary or access report artifact](https://github.example/runs/1) instead.'
     )
   })
+
+  it('writes the full access report as a side effect of the action helper', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'access-report-'))
+    const reportPath = join(dir, 'ACCESS_REPORT.md')
+    const originalPath = process.env.ACCESS_REPORT_PATH
+
+    try {
+      process.env.ACCESS_REPORT_PATH = reportPath
+      const comment = await runDescribeAccessChanges()
+      const report = readFileSync(reportPath, 'utf8')
+
+      assert.match(comment, /<details><summary>Access Changes<\/summary>/)
+      assert.doesNotMatch(comment, /Potential no members/)
+      assert.match(report, /<summary>Potential no members<\/summary>/)
+    } finally {
+      if (originalPath === undefined) {
+        delete process.env.ACCESS_REPORT_PATH
+      } else {
+        process.env.ACCESS_REPORT_PATH = originalPath
+      }
+      rmSync(dir, {recursive: true, force: true})
+    }
+  })
 })
diff --git a/scripts/src/actions/shared/describe-access-changes.ts b/scripts/src/actions/shared/describe-access-changes.ts
index b4120a4..3a163d7 100644
--- a/scripts/src/actions/shared/describe-access-changes.ts
+++ b/scripts/src/actions/shared/describe-access-changes.ts
@@ -1,6 +1,7 @@
 import {Config} from '../../yaml/config.js'
 import {State} from '../../terraform/state.js'
 import * as core from '@actions/core'
+import * as fs from 'fs'
 import {
   categorizeAccessSummary,
   formatAccessSummarySection,
@@ -13,7 +14,10 @@ const GITHUB_COMMENT_LENGTH_LIMIT = 65000
 export async function runDescribeAccessChanges(): Promise<string> {
   const state = await State.New()
   const config = Config.FromPath()
+  const accessReport = describeAccessReport(state, config)
+  const accessReportPath = process.env.ACCESS_REPORT_PATH ?? 'ACCESS_REPORT.md'
 
+  fs.writeFileSync(accessReportPath, accessReport)
   return describeAccessChangesComment(state, config)
 }