Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add json format output option #184

Merged
merged 1 commit into from
Aug 9, 2022
Merged

Add json format output option #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ Optionally, change the `fail-build` field to `false` to avoid failing the build

### Action Inputs

The inputs `image`, `path`, and `sbom` are mutually exclusive to specify the source to scan; all the other keys are optional. These are all the available keys to configure this action, along with the defaults:
The inputs `image`, `path`, and `sbom` are mutually exclusive to specify the source to scan;inputs `output-format` and`acs-report-enable` are mutually exclusive to specify the report format;all the other keys are optional. These are all the available keys to configure this action, along with the defaults:

| Input Name | Description | Default Value |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
Expand All @@ -126,14 +126,16 @@ The inputs `image`, `path`, and `sbom` are mutually exclusive to specify the sou
| `registry-username` | The registry username to use when authenticating to an external registry | |
| `registry-password` | The registry password to use when authenticating to an external registry | |
| `fail-build` | Fail the build if a vulnerability is found with a higher severity. That severity defaults to `"medium"` and can be set with `severity-cutoff`. | `true` |
| `acs-report-enable` | Generate a SARIF report and set the `sarif` output parameter after successful action execution. This report is compatible with GitHub Automated Code Scanning (ACS), as the artifact to upload for display as a Code Scanning Alert report. | `true` |
| `output-format` | Set the output parameter after successful action execution. Valid choices are "json" and "sarif" | `sarif` |
| `acs-report-enable` | Generate a SARIF report and set the `sarif` output parameter (Override the output-format) after successful action execution. This report is compatible with GitHub Automated Code Scanning (ACS), as the artifact to upload for display as a Code Scanning Alert report. | `true` |
| `severity-cutoff` | With ACS reporting enabled, optionally specify the minimum vulnerability severity to trigger an "error" level ACS result. Valid choices are "negligible", "low", "medium", "high" and "critical". Any vulnerability with a severity less than this value will lead to a "warning" result. Default is "medium". | `"medium"` |

### Action Outputs

| Output Name | Description | Type |
| ----------- | ----------------------------- | ------ |
| `sarif` | Path to the SARIF report file | string |
| `report` | Path to the report file | string |

### Example Workflows

Expand Down
25 changes: 22 additions & 3 deletions dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,12 +103,14 @@ async function run() {
const source = sourceInput();
const failBuild = core.getInput("fail-build") || "true";
const acsReportEnable = core.getInput("acs-report-enable") || "true";
const outputFormat = core.getInput("output-format") || "sarif";
const severityCutoff = core.getInput("severity-cutoff") || "medium";
const out = await runScan({
source,
failBuild,
acsReportEnable,
severityCutoff,
outputFormat
});
Object.keys(out).map((key) => {
core.setOutput(key, out[key]);
Expand All @@ -118,7 +120,7 @@ async function run() {
}
}

async function runScan({ source, failBuild, acsReportEnable, severityCutoff }) {
async function runScan({ source, failBuild, acsReportEnable, severityCutoff ,outputFormat}) {
const out = {};

const env = {
Expand All @@ -139,6 +141,8 @@ async function runScan({ source, failBuild, acsReportEnable, severityCutoff }) {
}

const SEVERITY_LIST = ["negligible", "low", "medium", "high", "critical"];
const FORMAT_LIST = ["sarif", "json"];

let cmdArgs = [];

if (core.isDebug()) {
Expand All @@ -152,7 +156,7 @@ async function runScan({ source, failBuild, acsReportEnable, severityCutoff }) {
if (acsReportEnable) {
cmdArgs.push("-o", "sarif");
} else {
cmdArgs.push("-o", "json");
cmdArgs.push("-o", outputFormat);
}

if (
Expand All @@ -166,6 +170,17 @@ async function runScan({ source, failBuild, acsReportEnable, severityCutoff }) {
`Invalid severity-cutoff value is set to ${severityCutoff} - please ensure you are choosing either negligible, low, medium, high, or critical`
);
}
if (
!FORMAT_LIST.some(
(item) =>
typeof outputFormat.toLowerCase() === "string" &&
item === outputFormat.toLowerCase()
)
) {
throw new Error(
`Invalid output-format value is set to ${outputFormat} - please ensure you are choosing either json or sarif`
);
}

core.debug(`Installing grype version ${grypeVersion}`);
await installGrype(grypeVersion);
Expand Down Expand Up @@ -225,6 +240,10 @@ async function runScan({ source, failBuild, acsReportEnable, severityCutoff }) {
const SARIF_FILE = "./results.sarif";
fs.writeFileSync(SARIF_FILE, cmdOutput);
out.sarif = SARIF_FILE;
}else {
const REPORT_FILE = "./results.report";
fs.writeFileSync(REPORT_FILE, cmdOutput);
out.report = REPORT_FILE;
}

if (failBuild === true && exitCode > 0) {
Expand Down Expand Up @@ -6916,4 +6935,4 @@ module.exports = require("util");
/******/ // Load entry module and return exports
/******/ return __webpack_require__(932);
/******/ })()
;
;