diff --git a/README.md b/README.md index 99db07b..ab6ccc4 100644 --- a/README.md +++ b/README.md @@ -396,7 +396,8 @@ Following inputs can be used as `step.with` keys: | `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities | | `vuln-type` | String | `os,library` | Vulnerability types (os,library) | | `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed | -| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped | +| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped | +| `skip-files` | String | | Comma separated list of files where traversal is skipped | | `cache-dir` | String | | Cache directory | | `timeout` | String | `2m0s` | Scan timeout duration | | `ignore-policy` | String | | Filter vulnerabilities with OPA rego language | diff --git a/action.yaml b/action.yaml index 34c7d00..2e28e9e 100644 --- a/action.yaml +++ b/action.yaml @@ -49,6 +49,10 @@ inputs: description: 'comma separated list of directories where traversal is skipped' required: false default: '' + skip-files: + description: 'comma separated list of files to be skipped' + required: false + default: '' cache-dir: description: 'specify where the cache is stored' required: false @@ -85,3 +89,4 @@ runs: - '-n ${{ inputs.timeout }}' - '-o ${{ inputs.ignore-policy }}' - '-p ${{ inputs.hide-progress }}' + - '-q ${{ inputs.skip-files }}' diff --git a/entrypoint.sh b/entrypoint.sh index a85c7d2..fc5eb47 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,6 +1,6 @@ #!/bin/bash set -e -while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:" o; do +while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:" o; do case "${o}" in a) export scanType=${OPTARG} @@ -50,6 +50,9 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:" o; do p) export hideProgress=${OPTARG} ;; + q) + export skipFiles=${OPTARG} + ;; esac done @@ -112,6 +115,12 @@ fi if [ "$hideProgress" == "true" ];then ARGS="$ARGS --no-progress" fi +if [ "$skipFiles" ];then + for i in $(echo $skipFiles | tr "," "\n") + do + ARGS="$ARGS --skip-files $i" + done +fi echo "Running trivy with options: ${ARGS}" "${artifactRef}" echo "Global options: " "${GLOBAL_ARGS}"