feat: pass output_name safely, document it and cover it with tests

- Pass --output-name as a single argument so a name with spaces is not split.
- Drop a trailing .json from the name, KICS appends the extension itself.
- Resolve the entrypoint.sh conflict with the path flags now kept in "$@".
- Remove the output_name entry from args, nothing reads positional arguments.
- Document output_name in the README.
- Cover the flag, the report lookup and the cleanup with tests.

Author: cx-artur-ribeiro

README.md

@@ -193,6 +193,7 @@ Ensure that you're using the <a href="https://github.com/Checkmarx/kics-github-a
 | include_queries                           | a227ec01-f97a-4084-91a4-47b350c1db54                   | include only specified list of queries to the scan, cannot be provided with query exclusion flags                                                           | String  | No       | N/A                                                    |
 | output_formats                            | 'json,sarif'                                           | formats in which the results report will be exported                                                                                                        | String  | No       | json                                                   |
 | output_path                               | myResults/                                             | file path to store result in json format                                                                                                                    | String  | No       | "./"                                                   |
+| output_name                               | my-results                                             | name of the results report files, without extension (KICS adds .json, .sarif); defaults to results                                                          | String  | No       | results                                                |
 | payload_path                              | /tmp/mypayload.json                                    | file path to store source internal representation in JSON format                                                                                            | String  | No       | N/A                                                    |
 | queries                                   |                                                        | path to directory with queries (default "./assets/queries")                                                                                                 | String  | No       | ./assets/queries downloaded with the binaries          |
 | verbose                                   | true                                                   | verbose scan                                                                                                                                                | Boolean | No       | false                                                  |

action.yml

@@ -140,7 +140,6 @@ runs:
     - ${{ inputs.exclude_gitignore}}
     - ${{ inputs.output_formats }}
     - ${{ inputs.output_path }}
-    - ${{ inputs.output_name }}
     - ${{ inputs.payload_path }}
     - ${{ inputs.queries }}
     - ${{ inputs.verbose }}

entrypoint.sh

@@ -66,7 +66,11 @@ fi
 # Check for Output Path    #
 ############################
 
-CP_PATH="./results.json"
+# KICS appends the extension itself, so a trailing .json would only confuse the file lookup
+INPUT_OUTPUT_NAME="${INPUT_OUTPUT_NAME%.json}"
+[[ ! -z "$INPUT_OUTPUT_NAME" ]] && set -- "$@" --output-name "$INPUT_OUTPUT_NAME"
+
+CP_PATH="./${INPUT_OUTPUT_NAME:-results}.json"
 if [ ! -z "$INPUT_OUTPUT_PATH" ]; then
     set -- "$@" -o "$INPUT_OUTPUT_PATH"
     CP_PATH=$INPUT_OUTPUT_PATH

test/e2e/entrypoint.test.js

@@ -64,6 +64,7 @@ test('inputs mapped to KICS flags', async (t) => {
         ['exclude_categories', 'Observability,Backup', '--exclude-categories'],
         ['platform_type', 'Terraform,Dockerfile', '--type'],
         ['type', 'Ansible,Dockerfile', '--type'],
+        ['output_name', 'my-results', '--output-name'],
         ['fail_on', 'high,medium', '--fail-on'],
         ['timeout', '60', '--timeout'],
         ['profiling', 'CPU', '--profiling'],
@@ -93,6 +94,7 @@ test('inputs mapped to KICS flags', async (t) => {
         ['secrets_regexes_path', 'my dir/secret regexes.json', '-r'],
         ['queries', 'my queries,team queries', '-q'],
         ['output_path', 'my out', '-o'],
+        ['output_name', 'my results', '--output-name'],
     ]
     for (const [input, value, flag] of withSpaces) {
         await t.test(`${input} keeps a value containing spaces as one argument`, async (t) => {
@@ -101,6 +103,15 @@ test('inputs mapped to KICS flags', async (t) => {
         })
     }
 
+    await t.test('output_name is given to KICS without the .json extension it appends itself', async (t) => {
+        const run = await runEntrypoint(t, { inputs: { output_name: 'my-results.json' } })
+        assert.equal(flagValue(run.args, '--output-name'), 'my-results')
+    })
+
+    await t.test('output_name left unset -> no --output-name', async (t) => {
+        assert.ok(!(await runEntrypoint(t)).args.includes('--output-name'))
+    })
+
     const switches = [
         ['exclude_gitignore', '--exclude-gitignore'],
         ['disable_secrets', '--disable-secrets'],
@@ -248,6 +259,23 @@ test('whole action: entrypoint, KICS, JavaScript stage and GitHub', async (t) =>
         assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
     })
 
+    for (const name of ['my-results', 'my results', 'my-results.json']) {
+        await t.test(`reports named "${name}" through output_name are picked up`, async (t) => {
+            const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: name, enable_jobs_summary: 'true' } })
+            assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
+        })
+    }
+
+    await t.test('reports named through output_name are picked up from output_path', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_path: 'reports', enable_jobs_summary: 'true' } })
+        assert.match(run.summary, /\| TOTAL \| 4 \|/, run.stdout + run.stderr)
+    })
+
+    await t.test('the workspace is left without the named report nobody asked for', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_name: 'my-results', output_formats: 'sarif' } })
+        assert.equal(fs.existsSync(path.join(run.workspace, 'my-results.json')), false)
+    })
+
     await t.test('results.json is left readable for the next workflow steps', async (t) => {
         const run = await runEntrypoint(t, { results: kicsResults() })
         const mode = fs.statSync(path.join(run.workspace, 'results.json')).mode

test/helpers/run-entrypoint.js

@@ -28,13 +28,18 @@ function sandboxedEntrypoint(sandbox) {
 const FAKE_KICS = `#!/bin/bash
 printf '%s\\n' "$@" > "$SANDBOX/kics-args.txt"
 out=./
+name=""
 while [ $# -gt 0 ]; do
   if [ "$1" = "-o" ]; then out="$2"; fi
+  if [ "$1" = "--output-name" ]; then name="$2"; fi
   shift
 done
+# like KICS: the name comes from --output-name (or the config file), and a trailing .json is not doubled
+name="\${name:-\${FAKE_KICS_NAME:-results}}"
+name="\${name%.json}"
 if [ -n "$FAKE_KICS_RESULTS" ]; then
   mkdir -p "$out"
-  file="$out/\${FAKE_KICS_NAME:-results}.json"
+  file="$out/$name.json"
   cp "$FAKE_KICS_RESULTS" "$file"
   chmod 755 "$file" # KICS v2.1.20 writes its reports world-readable
 fi