fix(actions): use repeated --format flag (argparse append mode)

--format uses action="append" in argparse, so multiple values must
be passed as separate flags: --format sarif --format json --format markdown

Not space-separated: --format sarif json markdown (breaks parsing,
causes silent failure with no output files)

Author: eFAILution

.github/actions/scanner-bandit/action.yml

@@ -79,7 +79,7 @@ runs:
         python -m argus scan bandit \
           --path "${SCAN_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./bandit-reports \
           --output-vars ./bandit-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-checkov/action.yml

@@ -137,7 +137,7 @@ runs:
         python -m argus scan checkov \
           --path "${IAC_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./checkov-reports \
           --output-vars ./checkov-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-clamav/action.yml

@@ -82,7 +82,7 @@ runs:
         python -m argus scan clamav \
           --path "${SCAN_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./clamav-reports \
           --output-vars ./clamav-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-gitleaks/action.yml

@@ -78,7 +78,7 @@ runs:
         python -m argus scan gitleaks \
           --path "${SCAN_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./gitleaks-reports \
           --output-vars ./gitleaks-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-opengrep/action.yml

@@ -92,7 +92,7 @@ runs:
         python -m argus scan opengrep \
           --path "${PATHS_INPUT}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./opengrep-reports \
           --output-vars ./opengrep-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-osv/action.yml

@@ -113,7 +113,7 @@ runs:
         python -m argus scan osv \
           --path "${SCAN_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./osv-reports \
           --output-vars ./osv-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-supply-chain/action.yml

@@ -112,7 +112,7 @@ runs:
         python -m argus scan supply-chain \
           --path "${SCAN_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./supply-chain-reports \
           --output-vars ./supply-chain-reports/counts.env \
           --no-timestamp \

.github/actions/scanner-trivy-iac/action.yml

@@ -114,7 +114,7 @@ runs:
         python -m argus scan trivy-iac \
           --path "${IAC_PATH}" \
           --severity-threshold "${FAIL_ON_SEVERITY:-none}" \
-          --format sarif json markdown \
+          --format sarif --format json --format markdown \
           --output-dir ./trivy-iac-reports \
           --output-vars ./trivy-iac-reports/counts.env \
           --no-timestamp \