Fix silent failure on large PRs (406 diff too large)

[MaxwellCalkin]

Summary

Fixes #80 — When a PR's unified diff exceeds GitHub's 20,000-line API limit, the action silently reports 0 findings instead of surfacing the error. This gives a false sense of security since the PR appears clean when no analysis actually occurred.

Changes

• Detect HTTP 406 in get_pr_diff() — Instead of letting raise_for_status() throw a generic error that gets swallowed, we now explicitly check for status 406 and fall back gracefully
• Fall back to local git diff — When the API returns 406, we run git diff origin/<base_ref>...HEAD locally (the action already checks out code), falling back to git diff HEAD~1 if needed
• New DiffTooLargeError exception — Raised only when both the API and all local diff fallbacks fail
• Structured "incomplete scan" output — When the diff cannot be obtained at all, the Python script outputs JSON with scan_status: "incomplete" and skip_reason: "diff_too_large" instead of an empty findings list
• Surface errors in action.yml — The shell wrapper now detects scan_status == "incomplete" and emits ::error:: annotations so the failure is visible in the GitHub Actions UI (instead of silently passing with 0 findings)

How it works

1. get_pr_diff() requests the diff from GitHub API
2. If HTTP 406 → calls _get_local_diff(base_ref) which tries:
   • git diff origin/main...HEAD (using PR's actual base branch)
   • git diff HEAD~1 (fallback)
3. If local diff succeeds → scan proceeds normally with locally-obtained diff
4. If local diff also fails → raises DiffTooLargeError, main() outputs structured error JSON, action.yml surfaces it as an error annotation

Tests

Added 9 new tests (176 total pass):

• 406 triggers local git diff fallback
• Tries origin/base...HEAD before HEAD~1
• Falls back to HEAD~1 when base ref fails
• Works without base_ref (uses only HEAD~1)
• Raises DiffTooLargeError when all fallbacks fail
• Handles git diff timeout gracefully
• Non-406 errors still raise normally
• Local diff output filters generated files
• main() produces structured incomplete scan output for DiffTooLargeError

Test plan

• All 176 existing tests pass (no regressions)
• 9 new unit tests covering all fallback paths
• Manual test with a PR exceeding 20K lines (requires large PR)

[blkdooGit]

Nice approach to the 406 — falling back to a local git diff sidesteps the API limit cleanly, and I opened #133 for a separate line that I think sits downstream of your fix.

The fallback recovers the same large diff, so on a PR big enough to hit the 406 the prompt still exceeds the model's context and the API returns Prompt is too long · the request is ~1139713 tokens (limit 1000000) .... The check at github_action_audit.py:263 compares that field for exact equality against Prompt is too long, so it never matches and the retry-without-diff branch at l.590-595 stays unreachable; the run then falls through _extract_security_findings and reports success with findings: [].

#133 is just that one line changed to a prefix match, plus tests. Entirely yours to fold in if it's easier as part of this PR — I raised it separately only because it's an independent defect from the 406 and your diff doesn't touch it.