Supporting running client with --tool (#17)

Supporting running client with --tools (#17)

Author: davidknise

action.yml

@@ -14,6 +14,8 @@ inputs:
     description: A comma separated list of analyzer categories to run. Values secrets, code, artifacts, IaC, containers. Example IaC,secrets. Defaults to all.
   languages:
     description: A comma separated list of languages to analyze. Example javascript, typescript. Defaults to all.
+  tools:
+    description: A comma separated list of analyzer tools to run. Example bandit, binskim, eslint, template-analyzer, terrascan, trivy.
 outputs:
   sarifFile:
     description: A file path to a SARIF results file.

lib/action.js

@@ -67,6 +67,17 @@ function run() {
                 }
             }
         }
+        let toolsString = core.getInput('tools');
+        if (!client.isNullOrWhiteSpace(toolsString)) {
+            let tools = toolsString.split(',');
+            args.push('--tool');
+            for (let i = 0; i < tools.length; i++) {
+                let tool = tools[i];
+                if (!client.isNullOrWhiteSpace(tool)) {
+                    args.push(tool.trim());
+                }
+            }
+        }
         args.push('--github');
         yield client.run(args, 'microsoft/security-devops-action');
     });

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "microsoft-security-devops-action",
-    "version": "1.4.0",
+    "version": "1.5.0",
     "description": "Node dependencies for the microsoft/security-devops-action.",
     "scripts": {
         "test": "mocha"

package-lock.json

@@ -45,6 +45,18 @@ async function run() {
         }
     }
 
+    let toolsString: string = core.getInput('tools');
+    if (!client.isNullOrWhiteSpace(toolsString)) {
+        let tools = toolsString.split(',');
+        args.push('--tool');
+        for (let i = 0; i < tools.length; i++) {
+            let tool = tools[i];
+            if (!client.isNullOrWhiteSpace(tool)) {
+                args.push(tool.trim());
+            }
+        }
+    }
+
     args.push('--github');
 
     await client.run(args, 'microsoft/security-devops-action');