Change the permissions on the entrypoint file

README.md

@@ -8,7 +8,11 @@ Example usage
 
 ```yaml
 name: tfsec
-on: [pull_request]
+on:
+  push:
+    branches:
+      - main
+  pull_request:
 jobs:
   tfsec:
     name: tfsec sarif report
@@ -22,5 +26,11 @@ jobs:
         uses: tfsec/tfsec-sarif-action@master
         with:
           github_token: ${{ secrets.github_token }}
-
+          branch: ${{ github.head_ref }} 
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: .sarif/tfsec.sarif         
 ```

action.yml

@@ -11,6 +11,8 @@ inputs:
       Directory to run the action on, from the repo root.
       Default is . ( root of the repository)
     default: '.'
+  sarif_file:
+    description: The path to write the sarif report, defaults to tfsec.sarif
 outputs:
   tfsec-return-code:
     description: 'tfsec command return code'

entrypoint.sh

@@ -1,20 +1,24 @@
 #!/bin/bash
 
+set -x
+
 if [ -n "${GITHUB_WORKSPACE}" ]; then
   cd "${GITHUB_WORKSPACE}" || exit
 fi
 
-mkdir -p .sarif
 
-tfsec --format=sarif "${INPUT_WORKING_DIRECTORY}" >> .sarif/tfsec.sarif
+tfsec --format=sarif "${INPUT_WORKING_DIRECTORY}" > ${INPUT_SARIF_FILE}
 
 tfsec_return="${PIPESTATUS[0]}" exit_code=$?
 
 echo ::set-output name=tfsec-return-code::"${tfsec_return}"
 
-sh -c "git config --global user.name '${GITHUB_ACTOR}' \
-      && git config --global user.email '${GITHUB_ACTOR}@users.noreply.github.com' \
-      && git add -A && git commit -m '$*' --allow-empty \
-      && git push -u origin HEAD"
+# echo "Input branch is ${INPUT_BRANCH}"
+
+# sh -c "git remote add origin ${INPUT_BRANCH} || git fetch --unshallow origin"
+
+# sh -c "git config --global user.name '${GITHUB_ACTOR}' \
+#       && git config --global user.email '${GITHUB_ACTOR}@users.noreply.github.com' \
+#       && git add .sarif/tfsec.sarif && git commit -m 'Updating tfsec.sarif file' --allow-empty \
+#       && git push -u origin HEAD:${INPUT_BRANCH} --force"
 
-exit $exit_code