feat: add option to specify one or more grype config files

[sam-super]

Fixes: #217

[sam-super]

Similar PR that didn't make it:
#427

[kzantow]

Hi @sam-super, I should note there are currently 2 ways to use Grype configuration in scan action:

• pass grype environment variables e.g. the env: key with GRYPE_ENV_VAR=... or even: GRYPE_CONFIG=<path-to-config>
• place a config file in a standard location, e.g. <repo-root>/.grype.yaml

While I'm not necessarily opposed to specifying a grype configuration file, I think a small part of the issue is that there is a mismatch between some of the configuration for the scan action and grype itself. But sbom-action does support a config file, so if we accept this it would need to use the same options

[sam-super]

Hi @kzantow,

For context we have a global grype config file and a local one, and currently we can't use both at the same time (which is the desired state). I originally tried passing GRYPE_CONFIG=one.yaml,two.yaml but it didn't work.

The individual grype env vars are unmaintainable as we are largely using this for ignores (which are a bit too complex).

So our only real option left is to merge the two configs ourselves (and then replace .grype.yaml with the merged one), but this seems unnecessary and error prone, considering grype cli already has the logic to handle multiple files.

I confess i don't really understand why the sbom-action inputs needs to be aligned with scan-action, unless it's just for consistency?
Either way i'm happy to change the name of the input to config if that is the issue?

Thanks for responding!

Hi @sam-super, I should note there are currently 2 ways to use Grype configuration in scan action:

* pass grype environment variables e.g. the `env:` key with `GRYPE_ENV_VAR=...` or even: `GRYPE_CONFIG=<path-to-config>`

* place a config file in a standard location, e.g. `<repo-root>/.grype.yaml`

While I'm not necessarily opposed to specifying a grype configuration file, I think a small part of the issue is that there is a mismatch between some of the configuration for the scan action and grype itself. But sbom-action does support a config file, so if we accept this it would need to use the same options

[sam-super]

FWIW have changed to config to match anyway: 907382b

[kzantow]

LGTM, thanks @sam-super

[sam-super]

Thanks @kzantow !