-
Notifications
You must be signed in to change notification settings - Fork 2
/
action.yml
47 lines (47 loc) · 1.87 KB
/
action.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: 'container-scan-to-sarif-action'
description: 'Converts Container Scan Action output to SARIF'
author: 'Armel Soro'
branding:
icon: 'check-circle'
color: 'yellow'
inputs:
converter-version:
description: 'Version of the container-scan-to-sarif tool. See https://github.com/rm3l/container-scan-to-sarif/releases'
required: false
default: '0.7.3'
input-file:
description: 'Path to the input Container Scan report to convert'
required: true
output-file:
description: 'Path to the output SARIF report to generate'
required: false
default: 'scanreport.sarif'
outputs:
sarif-report-path:
description: 'Path to the SARIF report generated'
value: ${{ steps.scan-to-sarif.outputs.sarif-report-path }}
runs:
using: "composite"
steps:
- id: container-scan-to-sarif-downloader
run: |
mkdir -p ~/.local/bin
curl -L "https://github.com/rm3l/container-scan-to-sarif/releases/download/${{ inputs.converter-version }}/container-scan-to-sarif_${{ inputs.converter-version }}_Linux_x86_64.tar.gz" \
| tar zx -C ~/.local/bin --strip-components=1
chmod +x ~/.local/bin/container-scan-to-sarif
shell: bash
- id: scan-to-sarif
run: |
# Converter versions >= 0.6.0 dropped support for the "-output" CLI option.
# Instead, they directly write the resulting SARIF to the standard output
if ~/.local/bin/container-scan-to-sarif --help | grep 'output string' > /dev/null; then \
~/.local/bin/container-scan-to-sarif \
-input "${{ inputs.input-file }}" \
-output "${{ inputs.output-file }}"; \
else \
~/.local/bin/container-scan-to-sarif \
-input "${{ inputs.input-file }}" \
| tee "${{ inputs.output-file }}"; \
fi
echo "::set-output name=sarif-report-path::${{ inputs.output-file }}"
shell: bash