fix: warn and suppress fail-on exit when fix mode is active in the Ac…

[coder-Yash886]

Summary
When a workflow sets both fail-on and fix: true, the scan step exits non-zero on findings before the "Apply security fixes" step runs. CLI-level fail-on suppression only applies when --fix and --fail-on are passed in the same invocation; in the Action they run in separate steps, so that behavior never helped.

This change updates the "Run CVE Lite CLI scan" step in action.yml to:

Emit a GitHub Actions warning when fix: true and fail-on are both set, so users know fail-on has no effect in fix mode
Suppress the scan step exit code when fix: true is active (cve-lite ... || true), so the fix step always runs regardless of findings
Closes #792

Test plan

Run a workflow with fix: true and fail-on: high on a project that has high-severity findings — scan step should not fail the job, and "Apply security fixes" should run

Confirm the workflow logs show ::warning::fail-on is set but has no effect in fix mode... when both inputs are set

Run a workflow with fail-on: high and fix: false — scan step should still exit non-zero on matching findings (unchanged behavior)

Run a workflow with fix: true and no fail-on — fix step runs normally with no warning

[coder-Yash886]

@sonukapoor Please review the Pr when you have free time

[sonukapoor]

Good diagnosis and the INPUT_FIX env var addition is correct - inputs need to be explicitly declared in composite action steps. One thing to tighten before we merge: || true suppresses all non-zero exits including exit 3 (genuine errors like a missing lockfile), not just exit 1 (findings that hit the fail-on threshold).

[coder-Yash886]

@sonukapoor both the changes are addressed Now review the pr

[sonukapoor]

Thanks for addressing the feedback - the exit code logic is correct on all four paths, the INPUT_FIX wiring follows the existing pattern, and the warning message is much more accurate now. Great fix!

[sonukapoor]

Merged - thank you @coder-Yash886!