feat: allow version to be specified (#21)

* feat: allow version to be specified

* fix: make empty version work

* fix: wire up outputs to composite step

Author: didroe

README.md

@@ -61,6 +61,10 @@ you can see this workflow in action on our [demo repo](https://github.com/Bearer
 
 ## Inputs
 
+### `version`
+
+**Optional** Specify the Bearer version to use. This must match a Bearer release name.
+
 ### `scanner`
 
 **Optional** Specify the comma-separated scanner to use e.g. `sast,secrets`

action.yml

@@ -4,6 +4,10 @@ branding:
   icon: "check-square"
   color: "purple"
 inputs:
+  version:
+    description: "Specify the Bearer version to use. This must match a Bearer release name."
+    required: false
+    default: ""
   scanner:
     description: "Specify the comma separated scanners e.g. --scanner secrets,sast"
     required: false
@@ -31,15 +35,28 @@ inputs:
 outputs:
   rule_breaches:
     description: "Details of any rule breaches that occur"
+    value: ${{ steps.run.outputs.rule_breaches }}
   exit_code:
     description: "exit code from binary"
+    value: ${{ steps.run.outputs.exit_code }}
 runs:
-  using: "docker"
-  image: "Dockerfile"
-  args:
-    - "--scanner=${{ inputs.scanner }}"
-    - "--config-file=${{ inputs.config-file }}"
-    - "--only-rule=${{ inputs.only-rule }}"
-    - "--skip-rule=${{ inputs.skip-rule }}"
-    - "--skip-path=${{ inputs.skip-path }}"
-    - "--severity=${{ inputs.severity }}"
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        VERSION="${{ inputs.version }}"
+        if [[ ! -z "$VERSION" ]]; then
+          VERSION="v${VERSION#v}"
+        fi
+
+        curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b "$RUNNER_TEMP" "$VERSION"
+    - id: run
+      shell: bash
+      run: |
+        $GITHUB_ACTION_PATH/entrypoint.sh \
+          "--scanner=${{ inputs.scanner }}" \
+          "--config-file=${{ inputs.config-file }}" \
+          "--only-rule=${{ inputs.only-rule }}" \
+          "--skip-rule=${{ inputs.skip-rule }}" \
+          "--skip-path=${{ inputs.skip-path }}" \
+          "--severity=${{ inputs.severity }}"

entrypoint.sh

@@ -3,7 +3,7 @@
 # Filter out any empty args
 args=$(for var in "$@"; do echo "$var";done | grep =.)
 
-RULE_BREACHES=`bearer scan --quiet ${args//$'\n'/ } .`
+RULE_BREACHES=`$RUNNER_TEMP/bearer scan --quiet ${args//$'\n'/ } .`
 SCAN_EXIT_CODE=$?
 
 echo "::debug::$RULE_BREACHES"