Action fails when used with the suggested calling syntax

[ant0nsc]

On github marketplace, it suggests to include this action with the following snippet:

- name: security-devops-action
  uses: microsoft/security-devops-action@v1.5.0

However, doing that results in a workflow failure. I tried this on my repo, but the resulting pipeline failed saying that Guardian wants --config or --tools

[markphip]

I am just checking this action out for first time and wanted to see what Issues are open .. keep that in mind. I will just note you are running your Action workflow on Ubuntu but the README says this action currently only works on Windows. So that could explain the error you are receiving. Try changing your job to run on windows-latest runner?

[johnemau]

I am hitting the same failure and have the workflow configured to run on windows-latest.

It looks like the issue is the action has no way of providing a path to a configuration file (either a generic config file or a tool specific config file). This appears to be a required parameter to the command line the action is calling, however the action does not provide the argument (Sounds like a bug 🪲).

I attempted to side-step the issue by providing a configuration file on disk with the hope it would be automatically discovered and picked up by the tooling, unfortunately that is not the case.

[ant0nsc]

Hi @markphip , unfortunately I get exactly the same error when running on windows-latest: https://github.com/microsoft/hi-ml/runs/6755283504?check_suite_focus=true

[markphip]

Yeah the previous comment said the same thing. I am also just a user so I do not have anything else to add.

[ivadim]

I can be wrong (just a user too), but you may need to add checkout step. I assume "autodetection" feature need files to determine the scans and create configs based on them.

[ant0nsc]

(facepalm) Thanks a ton @ivadim , that was precisely the problem. @johnemau, I think your pipeline has exactly the same problem, there's no checkout step.