Add config input

README.md

@@ -139,6 +139,7 @@ and uploading them as workflow artifacts and release assets.
 | `upload-release-assets`     | Upload release assets                                                                                                                                   | `true`                           |
 | `syft-version`              | The version of Syft to use                                                                                                                              |                                  |
 | `github-token`              | Authorized secret GitHub Personal Access Token.                                                                                                         | `github.token`                   |
+| `config `                   | Syft configuration file to use.                                                                                                                         |                                  |
 
 ### anchore/sbom-action/publish-sbom
 

action.yml

@@ -73,6 +73,10 @@ inputs:
     description: "Upload release assets"
     default: "true"
 
+  config:
+    required: false
+    description: "Configuration file to use"
+
 runs:
   using: "node16"
   main: "dist/runSyftAction/index.js"

src/Syft.ts

@@ -47,4 +47,5 @@ export interface SyftOptions {
     | "text"
     | "json";
   uploadToDependencySnapshotAPI: boolean;
+  configFile: string;
 }

src/github/SyftGithubAction.ts

@@ -150,6 +150,10 @@ async function executeSyft({
     args = [...args, "-o", `github=${githubDependencySnapshotFile}`];
   }
 
+  if (opts.configFile) {
+    args = [...args, "-c", opts.configFile];
+  }
+
   // Execute in a group so the syft output is collapsed in the GitHub log
   core.info(`[command]${cmd} ${args.join(" ")}`);
 
@@ -367,6 +371,7 @@ export async function runSyftAction(): Promise<void> {
     },
     format: getSbomFormat(),
     uploadToDependencySnapshotAPI: uploadToSnapshotAPI(),
+    configFile: core.getInput("config"),
   });
 
   core.info(`SBOM scan completed in: ${(Date.now() - start) / 1000}s`);

tests/SyftGithubAction.test.ts

@@ -403,4 +403,19 @@ describe("Action", () => {
     expect(mapToWSLPath("D:\\Some\\Path")).toBe("/mnt/d/Some/Path");
     expect(mapToWSLPath("C:\\Some\\Path")).toBe("/mnt/c/Some/Path");
   });
+
+  it("calls with config", async () => {
+    setData({
+      inputs: {
+        image: "some-image:latest",
+        config: "syft-config.yaml",
+      }
+    });
+
+    await action.runSyftAction();
+    const { cmd, args, env } = data.execArgs;
+
+    expect(args).toContain("-c");
+    expect(args).toContain("syft-config.yaml");
+  });
 });