Add fail-on-no-inputs option (#67)

Author: woodruffw

README.md

@@ -263,6 +263,19 @@ See the [Configuration - Discovery] documentation for how explicit configuration
 
 [Configuration - Discovery]: https://docs.zizmor.sh/configuration/#discovery
 
+### `fail-on-no-inputs`
+
+*Default*: `true`
+
+`fail-on-no-inputs` controls whether the action fails if no inputs
+were collected by `zizmor`. If set to `false`, the action will
+succeed even if no inputs were found.
+
+> [!IMPORTANT]
+> This input only works with `zizmor v1.21.0` and later. It has no effect
+> on earlier versions of `zizmor`, meaning that the action will always fail
+> if no inputs are found on earlier versions.
+
 ## Permissions
 
 `zizmor-action` requires different permissions depending on how you use it.

action.sh

@@ -2,7 +2,7 @@
 
 # action.sh: run zizmor via Docker
 
-set -euo pipefail
+set -eu
 
 dbg() {
     echo "::debug::${*}"
@@ -106,3 +106,13 @@ docker run \
     -- \
     ${GHA_ZIZMOR_INPUTS} \
         | tee "${output}"
+
+exitcode="${PIPESTATUS[0]}"
+dbg "zizmor exited with code ${exitcode}"
+
+if [[ "${exitcode}" -eq 3 ]]; then
+    warn "No inputs were collected by zizmor"
+    [[ "${GHA_ZIZMOR_FAIL_ON_NO_INPUTS}" = "false" ]] && exit 0
+fi
+
+exit "${exitcode}"

action.yml

@@ -73,7 +73,18 @@ inputs:
   config:
     description: Path to a custom zizmor configuration file Path (e.g., zizmor.yml).
     required: false
+  fail-on-no-inputs:
+    description: |
+      Whether the action should fail if no inputs are collected by zizmor.
+
+      By default, zizmor will fail if it couldn't collect any inputs to audit.
+      Setting this option to `false` will make the action succeed in such cases,
+      with a warning message instead.
 
+      This input only works with zizmor v1.21.0 and later. Earlier versions
+      will always fail on no inputs.
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -94,6 +105,7 @@ runs:
         GHA_ZIZMOR_COLOR: ${{ inputs.color }}
         GHA_ZIZMOR_ANNOTATIONS: ${{ inputs.annotations }}
         GHA_ZIZMOR_CONFIG: ${{ inputs.config }}
+        GHA_ZIZMOR_FAIL_ON_NO_INPUTS: ${{ inputs.fail-on-no-inputs }}
       shell: bash
 
     - name: Upload SARIF file to GitHub Advanced Security