Not able to pass output from earlier step as text

[richa-p]

Hello,

I'm trying to read a file and then send it in Text section but it's not working. Here is the sample:

• name: Read scan results summary
  id: scan-results
  run: |
  SAST_SUMMARY=$(cat sast-summary.txt)
  echo "::set-output name=SAST_SUMMARY::${SAST_SUMMARY}"
• name: Send a message to Microsoft Teams
  if: ${{ steps.pipeline-scan.outcome == 'failure' }}
  uses: aliencube/[email protected]
  with:
  webhook_uri: ${{env.WEBHOOK_URI}}
  title: 'Veracode Pipeline Scan found vulnerabilities in ${{ env.REPOSITORY_NAME }}'
  summary: 'Flaws Summary: '
  text: 'Flaws text: ${{steps.scan-results.outputs.SAST_SUMMARY}}'
  theme_color: a72828
  actions: '[{ "@type": "OpenUri", "name": "View Results", "targets": [{ "os": "default", "uri": "https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" }] }]'

Am I missing anything? Or this is not supported with the current version?

[riker09]

Is this the content of your YAML file?

jobs:
  your-job:
    runs-on: ubuntu-latest
    steps:
    - name: Read scan results summary
      id: scan-results
      run: |
        SAST_SUMMARY=$(cat sast-summary.txt)
        echo "::set-output name=SAST_SUMMARY::${SAST_SUMMARY}"
    - name: Send a message to Microsoft Teams
      if: ${{ steps.pipeline-scan.outcome == 'failure' }}
      uses: aliencube/[email protected]
      with:
        webhook_uri: ${{env.WEBHOOK_URI}}
        title: 'Veracode Pipeline Scan found vulnerabilities in ${{ env.REPOSITORY_NAME }}'
        summary: 'Flaws Summary: '
        text: 'Flaws text: ${{steps.scan-results.outputs.SAST_SUMMARY}}'
        theme_color: a72828
        actions: '[{ "@type": "OpenUri", "name": "View Results", "targets": [{ "os": "default", "uri": "https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" }] }]'

(I have added the jobs to steps paragraphs)

Do you get any errors?

From my experience the workflow files are pretty fragile when it comes to single and double quotes. If your output SAST_SUMMARY contains single quotes this might break the second step since text is also single-quote-escaped.

[richa-p]

Thanks for your response.
Correct that's the step configured in yaml file and SAST_SUMMARY may or may not contain single quotes.

I can give a try with double quotes, but then if for some reason SAST_SUMMARY has double quotes, then it will fail again.

[riker09]

Yup, unfortunately that is something one must be aware of. I think you should opt for either double or single quotes and then take every action you can think of to make sure that the quotes are properly escaped.