diff --git a/README.md b/README.md index 132fef5..53d10d6 100644 --- a/README.md +++ b/README.md @@ -193,6 +193,7 @@ Ensure that you're using the { ['exclude_categories', 'Observability,Backup', '--exclude-categories'], ['platform_type', 'Terraform,Dockerfile', '--type'], ['type', 'Ansible,Dockerfile', '--type'], + ['output_name', 'my-results', '--output-name'], ['fail_on', 'high,medium', '--fail-on'], ['timeout', '60', '--timeout'], ['profiling', 'CPU', '--profiling'], @@ -93,6 +94,7 @@ test('inputs mapped to KICS flags', async (t) => { ['secrets_regexes_path', 'my dir/secret regexes.json', '-r'], ['queries', 'my queries,team queries', '-q'], ['output_path', 'my out', '-o'], + ['output_name', 'my results', '--output-name'], ] for (const [input, value, flag] of withSpaces) { await t.test(`${input} keeps a value containing spaces as one argument`, async (t) => { @@ -101,6 +103,15 @@ test('inputs mapped to KICS flags', async (t) => { }) } + await t.test('output_name is given to KICS without the .json extension it appends itself', async (t) => { + const run = await runEntrypoint(t, { inputs: { output_name: 'my-results.json' } }) + assert.equal(flagValue(run.args, '--output-name'), 'my-results') + }) + + await t.test('output_name left unset -> no --output-name', async (t) => { + assert.ok(!(await runEntrypoint(t)).args.includes('--output-name')) + }) + const switches = [ ['exclude_gitignore', '--exclude-gitignore'], ['disable_secrets', '--disable-secrets'], @@ -248,6 +259,23 @@ test('whole action: entrypoint, KICS, JavaScript stage and GitHub', async (t) => assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr) }) + for (const name of ['my-results', 'my results', 'my-results.json']) { + await t.test(`reports named "${name}" through output_name are picked up`, async (t) => { + const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: name, enable_jobs_summary: 'true' } }) + assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr) + }) + } + + await t.test('reports named through output_name are picked up from output_path', async (t) => { + const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_path: 'reports', enable_jobs_summary: 'true' } }) + assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr) + }) + + await t.test('the workspace is left without the named report nobody asked for', async (t) => { + const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_formats: 'sarif' } }) + assert.equal(fs.existsSync(path.join(run.workspace, 'my-results.json')), false) + }) + await t.test('results.json is left readable for the next workflow steps', async (t) => { const run = await runEntrypoint(t, { results: kicsResults() }) const mode = fs.statSync(path.join(run.workspace, 'results.json')).mode diff --git a/test/helpers/run-entrypoint.js b/test/helpers/run-entrypoint.js index 27550cb..1d45270 100644 --- a/test/helpers/run-entrypoint.js +++ b/test/helpers/run-entrypoint.js @@ -28,13 +28,18 @@ function sandboxedEntrypoint(sandbox) { const FAKE_KICS = `#!/bin/bash printf '%s\\n' "$@" > "$SANDBOX/kics-args.txt" out=./ +name="" while [ $# -gt 0 ]; do if [ "$1" = "-o" ]; then out="$2"; fi + if [ "$1" = "--output-name" ]; then name="$2"; fi shift done +# like KICS: the name comes from --output-name (or the config file), and a trailing .json is not doubled +name="\${name:-\${FAKE_KICS_NAME:-results}}" +name="\${name%.json}" if [ -n "$FAKE_KICS_RESULTS" ]; then mkdir -p "$out" - file="$out/\${FAKE_KICS_NAME:-results}.json" + file="$out/$name.json" cp "$FAKE_KICS_RESULTS" "$file" chmod 755 "$file" # KICS v2.1.20 writes its reports world-readable fi