fix: Fix 'tf-var' arg not passing when using 'sarif' format

[antigenius0910]

fix #310

When using sarif format and tf-var args together

ᐅ docker run -it trivy-action \
"-a config" \
"-b sarif" \
"-c " \
"-d 1" \
"-e false" \
"-f os,library" \
"-g CRITICAL,HIGH" \
"-h trivy-results.sarif" \
"-i " \
"-j ." \
"-k " \
"-l " \
"-m " \
"-n " \
"-o " \
"-p false" \
"-q " \
"-r false" \
"-s " \
"-t " \
"-u " \
"-v " \
"-x ./terraform/terraform.tfvars.json" \
"-z "

tf-var arg will not pass, and since it is --quiet people don't know what happen and scan will not kick in

+ echo 'Building SARIF report with options:  --exit-code  1' .
Building SARIF report with options:  --exit-code  1 .
+ trivy --quiet config --format sarif --output trivy-results.sarif --exit-code 1 .

after this fix

Building SARIF report with options:  --exit-code  1 --tf-vars  ./terraform/terraform.tfvars.json .
Ignore all severity level being defined since limit-severities-for-sarif: false
2024-02-17T19:53:09.430Z        INFO    Misconfiguration scanning is enabled
2024-02-17T19:53:09.430Z        INFO    Need to update the built-in policies
2024-02-17T19:53:09.430Z        INFO    Downloading the built-in policies...
45.79 KiB / 45.79 KiB [-------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2024-02-17T19:53:10.621Z        INFO    Detected config files: 0

[CLAassistant]

All committers have signed the CLA.

[simar7]

In order to support existing and future trivy options, we offer the ability to pass in a configuration file to the GitHub action. This allows users to not have to wait on us to add yet another flag to the Trivy GitHub action to support another option in Trivy. Not to mention that adding additional options to the already existing ones clutters the codebase of the action and is better handled within Trivy itself.

You can find info on how to configure the action via the config yaml file here

[jonathanio]

@simar7 I've hit this issue in several ways recently, and unfortunately, the method you described does not work:

trivy-action/entrypoint.sh

Line 190 in 207cd40

if [ "${format}" == "sarif" ] && [ "${limitSeveritiesForSARIF}" != "true" ]; then

The GitHub Action explicitly excludes the trivy-config argument when processing the command line for the call to trivy (unless you configure the override). Therefore, the tf-vars argument needs to be added in entrypoint.sh to be processed in this use case; it will never be picked up in .trivy.yaml so long as the SARIF output is needed (like for passing to GitHub Advanced Security) and you do not also override using limit-severities-for-sarif, which is not clear in the documentation.

The same issue exists with trivyignores. Either these need to be fixed directly, or the processing around SARIF outputs needs to be changed to be more permissive and allow trivy-config to be passed.