feat: add option to specify one or more grype config files

README.md

@@ -136,6 +136,7 @@ The inputs `image`, `path`, and `sbom` are mutually exclusive to specify the sou
 | `vex`               | Specify a list of VEX documents to consider when producing scanning results.                                                                                                                                                                                     | `false`       |
 | `cache-db`          | Cache the Grype DB in GitHub action cache and restore before checking for updates                                                                                                                                                                                | `false`       |
 | `grype-version`     | An optional Grype version to download, defaults to the pinned version in [GrypeVersion.js](GrypeVersion.js).                                                                                                                                                     |               |
+| `config`            | Optional Grype configuration files (newline-separated). Setting this will disable auto-detection of configuration files (e.g. .grype.yaml) - only the specified files will be loaded..                                                                           |               |
 
 ### Action Outputs
 

action.yml

@@ -39,13 +39,16 @@ inputs:
   by-cve:
     description: "Specify whether to orient results by CVE rather than GHSA.  Default is false."
     required: false
-    default: "false"  
+    default: "false"
   grype-version:
     description: "A specific version of Grype to install"
     required: false
   vex:
     description: "Specify a list of VEX documents to consider when producing scanning results."
     required: false
+  config:
+    description: "Specify one or more Grype configuration files (newline-separated). Setting this will disable auto-detection of configuration files (e.g. .grype.yaml) - only the specified files will be loaded."
+    required: false
   cache-db:
     description: "Cache the Grype DB in GitHub action cache and restore before checking for updates"
     required: false

dist/index.js

@@ -147,6 +147,7 @@ async function run() {
     const addCpesIfNone = core.getInput("add-cpes-if-none") || "false";
     const byCve = core.getInput("by-cve") || "false";
     const vex = core.getInput("vex") || "";
+    const configFile = core.getInput("config") || "";
     const cacheDb = core.getInput("cache-db") || "false";
     const outputFile = core.getInput("output-file") || "";
     const out = await runScan({
@@ -159,6 +160,7 @@ async function run() {
       addCpesIfNone,
       byCve,
       vex,
+      configFile,
       cacheDb,
     });
     Object.keys(out).map((key) => {
@@ -309,6 +311,7 @@ async function runScan({
   addCpesIfNone,
   byCve,
   vex,
+  configFile,
   cacheDb,
 }) {
   const out = {};
@@ -425,6 +428,16 @@ async function runScan({
     cmdArgs.push("--vex");
     cmdArgs.push(vex);
   }
+  if (configFile) {
+    const configFiles = configFile
+      .split("\n")
+      .map((f) => f.trim())
+      .filter((f) => f);
+    for (const cf of configFiles) {
+      cmdArgs.push("-c");
+      cmdArgs.push(cf);
+    }
+  }
   cmdArgs.push(source);
 
   const { exitCode } = await runCommand(grypeCommand, cmdArgs, env);

index.js

@@ -133,6 +133,7 @@ async function run() {
     const addCpesIfNone = core.getInput("add-cpes-if-none") || "false";
     const byCve = core.getInput("by-cve") || "false";
     const vex = core.getInput("vex") || "";
+    const configFile = core.getInput("config") || "";
     const cacheDb = core.getInput("cache-db") || "false";
     const outputFile = core.getInput("output-file") || "";
     const out = await runScan({
@@ -145,6 +146,7 @@ async function run() {
       addCpesIfNone,
       byCve,
       vex,
+      configFile,
       cacheDb,
     });
     Object.keys(out).map((key) => {
@@ -295,6 +297,7 @@ async function runScan({
   addCpesIfNone,
   byCve,
   vex,
+  configFile,
   cacheDb,
 }) {
   const out = {};
@@ -411,6 +414,16 @@ async function runScan({
     cmdArgs.push("--vex");
     cmdArgs.push(vex);
   }
+  if (configFile) {
+    const configFiles = configFile
+      .split("\n")
+      .map((f) => f.trim())
+      .filter((f) => f);
+    for (const cf of configFiles) {
+      cmdArgs.push("-c");
+      cmdArgs.push(cf);
+    }
+  }
   cmdArgs.push(source);
 
   const { exitCode } = await runCommand(grypeCommand, cmdArgs, env);

tests/grype_command.test.js

@@ -177,6 +177,60 @@ describe("Grype command args", () => {
       "dir:asdf",
     ]);
   });
+
+  it("adds single config file if specified", async () => {
+    const args = await mockRun({
+      image: "asdf",
+      "fail-build": "false",
+      "output-file": "the-output-file",
+      "output-format": "json",
+      "severity-cutoff": "low",
+      "only-fixed": "false",
+      "add-cpes-if-none": "false",
+      "by-cve": "false",
+      config: ".grype-custom.yaml",
+    });
+    expect(args).toEqual([
+      "-v",
+      "-o",
+      "json",
+      "--file",
+      "the-output-file",
+      "--fail-on",
+      "low",
+      "-c",
+      ".grype-custom.yaml",
+      "asdf",
+    ]);
+  });
+
+  it("adds multiple config files if specified", async () => {
+    const args = await mockRun({
+      image: "asdf",
+      "fail-build": "false",
+      "output-file": "the-output-file",
+      "output-format": "json",
+      "severity-cutoff": "low",
+      "only-fixed": "false",
+      "add-cpes-if-none": "false",
+      "by-cve": "false",
+      config: "base.yaml\noverrides.yaml",
+    });
+    expect(args).toEqual([
+      "-v",
+      "-o",
+      "json",
+      "--file",
+      "the-output-file",
+      "--fail-on",
+      "low",
+      "-c",
+      "base.yaml",
+      "-c",
+      "overrides.yaml",
+      "asdf",
+    ]);
+  });
 });
 
 async function mockRun(inputs) {