Basic Sobelow action with sarif file output

Dockerfile

@@ -2,4 +2,8 @@ FROM elixir:1.11.2
 
 COPY sobelow.sh /sobelow.sh
 
+ENV DIR=GITHUB_WORKSPACE
+
+WORKDIR ${DIR}
+
 ENTRYPOINT ["/sobelow.sh"]

README.md

@@ -1,3 +1,3 @@
 # Sobelow Action
 
-...
+

action.yml

@@ -3,11 +3,16 @@ author: Griffin Byatt
 description: Security-focused static analysis for the Phoenix Framework
 
 inputs:
+  report:
+    required: true
+    description: "Output a results.sarif file for GitHub Security integration"
+    default: true
   flags:
     description: "Flags (https://github.com/nccgroup/sobelow#options)"
 
 runs:
   using: 'docker'
   image: 'Dockerfile'
   args:
-    - ${{ inputs.flags }}
+    - ${{ inputs.flags }}
+    - ${{ inputs.report }}

sobelow.sh

@@ -1,6 +1,10 @@
 #!/bin/sh -l
 
 mix local.hex --force
-mix escript.install github nccgroup/sobelow --force
+mix escript.install hex sobelow --force
 
-~/.mix/escripts/sobelow $1
+if [ "$2" = "false" ]; then
+    ~/.mix/escripts/sobelow $1
+else
+    ~/.mix/escripts/sobelow $1 --format sarif >> results.sarif
+fi