Handle empty policy response as no policy found

API returns 200 with empty policy (no egress_policy, no endpoints)
when no policy exists for a repo. Treat this as no policy found and
default to audit mode. Update action.yml descriptions for policy store.

dist/pre/index.js

@@ -85297,7 +85297,11 @@ function fetchPolicyFromStore(owner, repo, apiKey, workflow, runId, correlationI
         if (response.statusCode === 404) {
             return null;
         }
-        return response.result;
+        const result = response.result;
+        if (!result || (!result.egress_policy && (!result.allowed_endpoints || result.allowed_endpoints.length === 0))) {
+            return null;
+        }
+        return result;
     });
 }
 function mergeConfigs(localConfig, remoteConfig) {

src/policy-utils.test.ts

@@ -191,6 +191,21 @@ test("fetchPolicyFromStore returns null when policy not found (404)", async () =
   expect(result).toBeNull();
 });
 
+test("fetchPolicyFromStore returns null when API returns empty policy", async () => {
+  const owner = "test-owner";
+  const repo = "nonexistent-repo";
+  const workflow = "ci.yml";
+  const runId = "12345";
+  const correlationId = "abc-def";
+
+  nock(`${STEPSECURITY_API_URL}`)
+    .get(`/github/${owner}/${repo}/actions/policies/workflow-policy?${policyStoreQueryString(workflow, runId, correlationId)}`)
+    .reply(200, { allowed_endpoints: [], egress_policy: "", policy_name: "" });
+
+  const result = await fetchPolicyFromStore(owner, repo, "my-api-key", workflow, runId, correlationId);
+  expect(result).toBeNull();
+});
+
 test("fetchPolicyFromStore retries on failure and succeeds", async () => {
   const owner = "test-owner";
   const repo = "test-repo";

src/policy-utils.ts

@@ -101,7 +101,12 @@ export async function fetchPolicyFromStore(
     return null;
   }
 
-  return response.result;
+  const result = response.result;
+  if (!result || (!result.egress_policy && (!result.allowed_endpoints || result.allowed_endpoints.length === 0))) {
+    return null;
+  }
+
+  return result;
 }
 
 export function mergeConfigs(