fix: announce when a config file is invalid and exit with a non-zero …

…code (#1242)

When looking into some other config stuff I realised the current loading
logic just assumes that an error is because a config doesn't exist and
silently falls back to the default one, when really it could be that
there is a config but it's invalid

cmd/osv-scanner/__snapshots__/main_test.snap

@@ -373,6 +373,29 @@ overriding license for package Packagist/league/flysystem/1.0.8 with 0BSD
 
 ---
 
+[TestRun/config_file_is_invalid - 1]
+Scanning dir ./fixtures/config-invalid
+Scanned <rootdir>/fixtures/config-invalid/composer.lock file and found 1 package
+
+---
+
+[TestRun/config_file_is_invalid - 2]
+Ignored invalid config file at: <rootdir>/fixtures/config-invalid/osv-scanner.toml
+
+---
+
+[TestRun/config_file_is_invalid#01 - 1]
+Scanning dir ./fixtures/config-invalid
+Scanned <rootdir>/fixtures/config-invalid/composer.lock file and found 1 package
+Config file <rootdir>/fixtures/config-invalid/osv-scanner.toml is invalid because: toml: line 1: expected '.' or '=', but got '!' instead
+
+---
+
+[TestRun/config_file_is_invalid#01 - 2]
+Ignored invalid config file at: <rootdir>/fixtures/config-invalid/osv-scanner.toml
+
+---
+
 [TestRun/cyclonedx_1.4_output - 1]
 {
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",

cmd/osv-scanner/fixtures/config-invalid/osv-scanner.toml

@@ -0,0 +1 @@
+!

cmd/osv-scanner/main_test.go

@@ -318,6 +318,17 @@ func TestRun(t *testing.T) {
 			args: []string{"", "--config=./fixtures/osv-scanner-composite-config.toml", "--experimental-licenses", "MIT", "./fixtures/locks-many", "./fixtures/locks-insecure"},
 			exit: 1,
 		},
+		// invalid config file
+		{
+			name: "config file is invalid",
+			args: []string{"", "./fixtures/config-invalid"},
+			exit: 127,
+		},
+		{
+			name: "config file is invalid",
+			args: []string{"", "--verbosity", "verbose", "./fixtures/config-invalid"},
+			exit: 127,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -175,6 +176,11 @@ func (c *ConfigManager) Get(r reporter.Reporter, targetPath string) Config {
 	if configErr == nil {
 		r.Infof("Loaded filter from: %s\n", config.LoadPath)
 	} else {
+		// anything other than the config file not existing is most likely due to an invalid config file
+		if !errors.Is(configErr, os.ErrNotExist) {
+			r.Errorf("Ignored invalid config file at: %s\n", configPath)
+			r.Verbosef("Config file %s is invalid because: %v\n", configPath, configErr)
+		}
 		// If config doesn't exist, use the default config
 		config = c.DefaultConfig
 	}
@@ -211,12 +217,12 @@ func tryLoadConfig(configPath string) (Config, error) {
 
 		_, err := toml.NewDecoder(file).Decode(&config)
 		if err != nil {
-			return Config{}, fmt.Errorf("failed to parse config file: %w", err)
+			return Config{}, err
 		}
 		config.LoadPath = configPath
 
 		return config, nil
 	}
 
-	return Config{}, fmt.Errorf("no config file found on this path: %s", configPath)
+	return Config{}, err
 }