diff --git a/action.yml b/action.yml index 24a2edd..deeac82 100644 --- a/action.yml +++ b/action.yml @@ -1,5 +1,5 @@ name: 'DevSkim' -description: 'Run DevSkim Code Analysis' +description: 'Run DevSkim Code Analysis and output Sarif compatible with GitHub Code Scanning alerts' inputs: directory-to-scan: description: 'The sub directory of the repository root to scan. Repository root used by default.' @@ -17,6 +17,10 @@ inputs: description: 'The sub directory for the output under GITHUB_WORKSPACE.' required: false default: 'GITHUB_WORKSPACE' + ignore-globs: + description: 'Optional comma separated list of file globs to ignore when scanning.' + required: false + default: "**/.git/**,**/bin/**" branding: icon: 'check-square' color: 'green' @@ -28,3 +32,4 @@ runs: - ${{ inputs.should-scan-archives }} - ${{ inputs.output-filename }} - ${{ inputs.output-directory }} + - ${{ inputs.ignore-globs }} \ No newline at end of file diff --git a/entrypoint.sh b/entrypoint.sh index a77f888..298b5fc 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -4,6 +4,7 @@ # $2 is if we should crawl archives # $3 is the output filename # $4 is the output directory +# $5 is the file globs to ignore if [ "$1" = "GITHUB_WORKSPACE" ]; then ScanTarget=$GITHUB_WORKSPACE @@ -21,4 +22,4 @@ if [ "$2" = "true" ]; then Opts = "-c" fi -/tools/devskim analyze "$ScanTarget" "$OutputDirectory/$3" -f sarif $Opts \ No newline at end of file +/tools/devskim analyze "$ScanTarget" "$OutputDirectory/$3" -f sarif $Opts -g $5 \ No newline at end of file