diff --git a/scan-dependencies/action.yml b/scan-dependencies/action.yml index 4c39def..b5d2115 100644 --- a/scan-dependencies/action.yml +++ b/scan-dependencies/action.yml @@ -2,6 +2,10 @@ name: 'Scan dependencies using the Mend.io CLI' description: 'Action to scan dependencies using the Mend.io CLI' inputs: + display_dependency_graph_link: + description: 'Whether to display the dependency graph link in the scan results' + default: 'true' + required: true github_url: description: 'The GitHub URL' default: 'https://github.com' @@ -57,6 +61,7 @@ runs: shell: bash run: | python ${GITHUB_ACTION_PATH}/mend-dependencies-sarif-converter.py \ + --display-dependency-graph-link "${{ inputs.display_dependency_graph_link }}" \ --input "${{ inputs.json_filename }}" \ --output "${{ inputs.sarif_filename }}" \ --github-url "${{ inputs.github_url }}" \ diff --git a/scan-dependencies/mend-dependencies-sarif-converter.py b/scan-dependencies/mend-dependencies-sarif-converter.py index d50b14f..b1b5cf2 100644 --- a/scan-dependencies/mend-dependencies-sarif-converter.py +++ b/scan-dependencies/mend-dependencies-sarif-converter.py @@ -129,8 +129,10 @@ def create_sarif(vulnerable_dependencies, dependencies_by_tool): ) markdown_msg = f"Recommendations for [{vuln_id}]({url}):

" \ - f"* {fixResolution}.

" \ - f"[View dependency graphs]({github_url}/{github_repository}/actions/runs/{workflow_run})
" + f"* {fixResolution}.

" + + if display_dependency_graph_link: + markdown_msg += f"[View dependency graphs]({github_url}/{github_repository}/actions/runs/{workflow_run})
" # Add formatted details results.append({ @@ -241,11 +243,13 @@ def main(input_file, output_file): print(f"Failed to write SARIF file: {e}") if __name__ == "__main__": + global display_dependency_graph_link global github_url global github_repository global workflow_run parser = argparse.ArgumentParser(description="Convert dependencies to SARIF with optional GitHub workflow link.") + parser.add_argument("--display-dependency-graph-link", default="true", help="Whether to display a link to the dependency graph") parser.add_argument("--github-url", help="The GitHub host URL") parser.add_argument("--github-repository", help="The GitHub repository owner/name") parser.add_argument("--input", default="dependencies.json", help="Path to input JSON file") @@ -253,6 +257,7 @@ def main(input_file, output_file): parser.add_argument("--workflow-run", help="GitHub Actions workflow run ID") args = parser.parse_args() + display_dependency_graph_link = args.display_dependency_graph_link github_url = args.github_url github_repository = args.github_repository workflow_run = args.workflow_run