diff --git a/README.md b/README.md index 2a1ad94..b1f1307 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,11 @@ Example usage ```yaml name: tfsec -on: [pull_request] +on: + push: + branches: + - main + pull_request: jobs: tfsec: name: tfsec sarif report @@ -22,5 +26,11 @@ jobs: uses: tfsec/tfsec-sarif-action@master with: github_token: ${{ secrets.github_token }} - + branch: ${{ github.head_ref }} + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: .sarif/tfsec.sarif ``` \ No newline at end of file diff --git a/action.yml b/action.yml index f9d4545..15756b2 100644 --- a/action.yml +++ b/action.yml @@ -11,6 +11,8 @@ inputs: Directory to run the action on, from the repo root. Default is . ( root of the repository) default: '.' + sarif_file: + description: The path to write the sarif report, defaults to tfsec.sarif outputs: tfsec-return-code: description: 'tfsec command return code' diff --git a/entrypoint.sh b/entrypoint.sh old mode 100644 new mode 100755 index 7b8b84c..226fe03 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,20 +1,24 @@ #!/bin/bash +set -x + if [ -n "${GITHUB_WORKSPACE}" ]; then cd "${GITHUB_WORKSPACE}" || exit fi -mkdir -p .sarif -tfsec --format=sarif "${INPUT_WORKING_DIRECTORY}" >> .sarif/tfsec.sarif +tfsec --format=sarif "${INPUT_WORKING_DIRECTORY}" > ${INPUT_SARIF_FILE} tfsec_return="${PIPESTATUS[0]}" exit_code=$? echo ::set-output name=tfsec-return-code::"${tfsec_return}" -sh -c "git config --global user.name '${GITHUB_ACTOR}' \ - && git config --global user.email '${GITHUB_ACTOR}@users.noreply.github.com' \ - && git add -A && git commit -m '$*' --allow-empty \ - && git push -u origin HEAD" +# echo "Input branch is ${INPUT_BRANCH}" + +# sh -c "git remote add origin ${INPUT_BRANCH} || git fetch --unshallow origin" + +# sh -c "git config --global user.name '${GITHUB_ACTOR}' \ +# && git config --global user.email '${GITHUB_ACTOR}@users.noreply.github.com' \ +# && git add .sarif/tfsec.sarif && git commit -m 'Updating tfsec.sarif file' --allow-empty \ +# && git push -u origin HEAD:${INPUT_BRANCH} --force" -exit $exit_code \ No newline at end of file