feat: add output_name input to map KICS --output-name CLI option (#154)

* feat: add output_name input to map KICS --output-name CLI option

* feat: pass output_name safely, document it and cover it with tests

- Pass --output-name as a single argument so a name with spaces is not split.
- Drop a trailing .json from the name, KICS appends the extension itself.
- Resolve the entrypoint.sh conflict with the path flags now kept in "$@".
- Remove the output_name entry from args, nothing reads positional arguments.
- Document output_name in the README.
- Cover the flag, the report lookup and the cleanup with tests.

---------

Co-authored-by: Artur Ribeiro <153724638+cx-artur-ribeiro@users.noreply.github.com>

Author: rasta-rocket

README.md

@@ -193,6 +193,7 @@ Ensure that you're using the <a href="https://github.com/Checkmarx/kics-github-a
 | include_queries                           | a227ec01-f97a-4084-91a4-47b350c1db54                   | include only specified list of queries to the scan, cannot be provided with query exclusion flags                                                           | String  | No       | N/A                                                    |
 | output_formats                            | 'json,sarif'                                           | formats in which the results report will be exported                                                                                                        | String  | No       | json                                                   |
 | output_path                               | myResults/                                             | file path to store result in json format                                                                                                                    | String  | No       | "./"                                                   |
+| output_name                               | my-results                                             | name of the results report files, without extension (KICS adds .json, .sarif); defaults to results                                                          | String  | No       | results                                                |
 | payload_path                              | /tmp/mypayload.json                                    | file path to store source internal representation in JSON format                                                                                            | String  | No       | N/A                                                    |
 | queries                                   |                                                        | path to directory with queries (default "./assets/queries")                                                                                                 | String  | No       | ./assets/queries downloaded with the binaries          |
 | verbose                                   | true                                                   | verbose scan                                                                                                                                                | Boolean | No       | false                                                  |

action.yml

@@ -71,6 +71,9 @@ inputs:
   output_path:
     description: "directory to store results report"
     required: false
+  output_name:
+    description: "name for output results file"
+    required: false
   payload_path:
     description: "file path to store source internal representation in JSON format"
     required: false
@@ -113,6 +116,7 @@ runs:
   env:
     INPUT_TOKEN: ${{ inputs.token }}
     INPUT_OUTPUT_PATH: ${{ inputs.output_path }}
+    INPUT_OUTPUT_NAME: ${{ inputs.output_name }}
     INPUT_ENABLE_ANNOTATIONS: ${{ inputs.enable_annotations }}
     INPUT_ENABLE_COMMENTS: ${{ inputs.enable_comments }}
     INPUT_ENABLE_JOBS_SUMMARY: ${{ inputs.enable_jobs_summary }}

entrypoint.sh

@@ -66,7 +66,11 @@ fi
 # Check for Output Path    #
 ############################
 
-CP_PATH="./results.json"
+# KICS appends the extension itself, so a trailing .json would only confuse the file lookup
+INPUT_OUTPUT_NAME="${INPUT_OUTPUT_NAME%.json}"
+[[ ! -z "$INPUT_OUTPUT_NAME" ]] && set -- "$@" --output-name "$INPUT_OUTPUT_NAME"
+
+CP_PATH="./${INPUT_OUTPUT_NAME:-results}.json"
 if [ ! -z "$INPUT_OUTPUT_PATH" ]; then
     set -- "$@" -o "$INPUT_OUTPUT_PATH"
     CP_PATH=$INPUT_OUTPUT_PATH

src/main.js

@@ -22,17 +22,18 @@ async function cleanupOutput(resultsJSONFile, outputFormats) {
     }
 }
 
-function processOutputPath(output) {
+function processOutputPath(output, outputName) {
+    const resultsFilename = outputName || "results";
     if (output === '') {
         return {
             path: "./",
-            resultsJSONFile: "./results.json"
+            resultsJSONFile: `./${resultsFilename}.json`
         }
     }
 
     return {
         path: output,
-        resultsJSONFile: filepath.join(output, "/results.json")
+        resultsJSONFile: filepath.join(output, `/${resultsFilename}.json`)
     }
 }
 
@@ -56,7 +57,7 @@ async function main() {
     let enableJobsSummary = process.env.INPUT_ENABLE_JOBS_SUMMARY;
     const commentsWithQueries = process.env.INPUT_COMMENTS_WITH_QUERIES;
     const excludedColumnsForCommentsWithQueries = process.env.INPUT_EXCLUDED_COLUMNS_FOR_COMMENTS_WITH_QUERIES.split(',');
-    const outputPath = processOutputPath(process.env.INPUT_OUTPUT_PATH);
+    const outputPath = processOutputPath(process.env.INPUT_OUTPUT_PATH, process.env.INPUT_OUTPUT_NAME);
     const outputFormats = process.env.INPUT_OUTPUT_FORMATS;
     const exitCode = process.env.KICS_EXIT_CODE
 

test/e2e/entrypoint.test.js

@@ -64,6 +64,7 @@ test('inputs mapped to KICS flags', async (t) => {
         ['exclude_categories', 'Observability,Backup', '--exclude-categories'],
         ['platform_type', 'Terraform,Dockerfile', '--type'],
         ['type', 'Ansible,Dockerfile', '--type'],
+        ['output_name', 'my-results', '--output-name'],
         ['fail_on', 'high,medium', '--fail-on'],
         ['timeout', '60', '--timeout'],
         ['profiling', 'CPU', '--profiling'],
@@ -93,6 +94,7 @@ test('inputs mapped to KICS flags', async (t) => {
         ['secrets_regexes_path', 'my dir/secret regexes.json', '-r'],
         ['queries', 'my queries,team queries', '-q'],
         ['output_path', 'my out', '-o'],
+        ['output_name', 'my results', '--output-name'],
     ]
     for (const [input, value, flag] of withSpaces) {
         await t.test(`${input} keeps a value containing spaces as one argument`, async (t) => {
@@ -101,6 +103,15 @@ test('inputs mapped to KICS flags', async (t) => {
         })
     }
 
+    await t.test('output_name is given to KICS without the .json extension it appends itself', async (t) => {
+        const run = await runEntrypoint(t, { inputs: { output_name: 'my-results.json' } })
+        assert.equal(flagValue(run.args, '--output-name'), 'my-results')
+    })
+
+    await t.test('output_name left unset -> no --output-name', async (t) => {
+        assert.ok(!(await runEntrypoint(t)).args.includes('--output-name'))
+    })
+
     const switches = [
         ['exclude_gitignore', '--exclude-gitignore'],
         ['disable_secrets', '--disable-secrets'],
@@ -248,6 +259,23 @@ test('whole action: entrypoint, KICS, JavaScript stage and GitHub', async (t) =>
         assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
     })
 
+    for (const name of ['my-results', 'my results', 'my-results.json']) {
+        await t.test(`reports named "${name}" through output_name are picked up`, async (t) => {
+            const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: name, enable_jobs_summary: 'true' } })
+            assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
+        })
+    }
+
+    await t.test('reports named through output_name are picked up from output_path', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_path: 'reports', enable_jobs_summary: 'true' } })
+        assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
+    })
+
+    await t.test('the workspace is left without the named report nobody asked for', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_formats: 'sarif' } })
+        assert.equal(fs.existsSync(path.join(run.workspace, 'my-results.json')), false)
+    })
+
     await t.test('results.json is left readable for the next workflow steps', async (t) => {
         const run = await runEntrypoint(t, { results: kicsResults() })
         const mode = fs.statSync(path.join(run.workspace, 'results.json')).mode

test/helpers/run-entrypoint.js

@@ -28,13 +28,18 @@ function sandboxedEntrypoint(sandbox) {
 const FAKE_KICS = `#!/bin/bash
 printf '%s\\n' "$@" > "$SANDBOX/kics-args.txt"
 out=./
+name=""
 while [ $# -gt 0 ]; do
   if [ "$1" = "-o" ]; then out="$2"; fi
+  if [ "$1" = "--output-name" ]; then name="$2"; fi
   shift
 done
+# like KICS: the name comes from --output-name (or the config file), and a trailing .json is not doubled
+name="\${name:-\${FAKE_KICS_NAME:-results}}"
+name="\${name%.json}"
 if [ -n "$FAKE_KICS_RESULTS" ]; then
   mkdir -p "$out"
-  file="$out/\${FAKE_KICS_NAME:-results}.json"
+  file="$out/$name.json"
   cp "$FAKE_KICS_RESULTS" "$file"
   chmod 755 "$file" # KICS v2.1.20 writes its reports world-readable
 fi