Add config input (#430)

* Add config input Allow a Syft configuration file to be passed to the action. Signed-off-by: Eugene Yakubovich <[email protected]> * rename config_file to configFile Signed-off-by: Will Murphy <[email protected]> --------- Signed-off-by: Eugene Yakubovich <[email protected]> Signed-off-by: Will Murphy <[email protected]> Co-authored-by: Will Murphy <[email protected]>
anchore · Nov 27, 2023 · a4126e6 · a4126e6
1 parent 9d0277c
commit a4126e6
Show file tree

Hide file tree

Showing 8 changed files with 38 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -139,6 +139,7 @@ and uploading them as workflow artifacts and release assets.
 | `upload-release-assets`     | Upload release assets                                                                                                                                   | `true`                           |
 | `syft-version`              | The version of Syft to use                                                                                                                              |                                  |
 | `github-token`              | Authorized secret GitHub Personal Access Token.                                                                                                         | `github.token`                   |
+| `config `                   | Syft configuration file to use.                                                                                                                         |                                  |
 
 ### anchore/sbom-action/publish-sbom
 

diff --git a/action.yml b/action.yml
@@ -73,6 +73,10 @@ inputs:
     description: "Upload release assets"
     default: "true"
 
+  config:
+    required: false
+    description: "Configuration file to use"
+
 runs:
   using: "node16"
   main: "dist/runSyftAction/index.js"
diff --git a/dist/attachReleaseAssets/index.js b/dist/attachReleaseAssets/index.js
diff --git a/dist/downloadSyft/index.js b/dist/downloadSyft/index.js
diff --git a/dist/runSyftAction/index.js b/dist/runSyftAction/index.js
diff --git a/src/Syft.ts b/src/Syft.ts
@@ -47,4 +47,5 @@ export interface SyftOptions {
     | "text"
     | "json";
   uploadToDependencySnapshotAPI: boolean;
+  configFile: string;
 }
diff --git a/src/github/SyftGithubAction.ts b/src/github/SyftGithubAction.ts
@@ -150,6 +150,10 @@ async function executeSyft({
     args = [...args, "-o", `github=${githubDependencySnapshotFile}`];
   }
 
+  if (opts.configFile) {
+    args = [...args, "-c", opts.configFile];
+  }
+
   // Execute in a group so the syft output is collapsed in the GitHub log
   core.info(`[command]${cmd} ${args.join(" ")}`);
 
@@ -367,6 +371,7 @@ export async function runSyftAction(): Promise<void> {
     },
     format: getSbomFormat(),
     uploadToDependencySnapshotAPI: uploadToSnapshotAPI(),
+    configFile: core.getInput("config"),
   });
 
   core.info(`SBOM scan completed in: ${(Date.now() - start) / 1000}s`);

diff --git a/tests/SyftGithubAction.test.ts b/tests/SyftGithubAction.test.ts
@@ -403,4 +403,19 @@ describe("Action", () => {
     expect(mapToWSLPath("D:\\Some\\Path")).toBe("/mnt/d/Some/Path");
     expect(mapToWSLPath("C:\\Some\\Path")).toBe("/mnt/c/Some/Path");
   });
+
+  it("calls with config", async () => {
+    setData({
+      inputs: {
+        image: "some-image:latest",
+        config: "syft-config.yaml",
+      }
+    });
+
+    await action.runSyftAction();
+    const { cmd, args, env } = data.execArgs;
+
+    expect(args).toContain("-c");
+    expect(args).toContain("syft-config.yaml");
+  });
 });