Output file contains additional character in the filename

[Jiri-Stary]

Issue:

Output file contain additional characters
Expected: hdf-results.json
Actual: hdf-results-.json

How to reproduce:
I have attached sample workflow for github action to reproduce
action.zip

1. Convert sample file to hdf

docker run -w /share -v$(pwd):/share mitre/saf convert snyk2hdf -i .github/actions/aggregate-report/sample_jfrog.json -o /share/hdf-results.json

2. try to open the resulting file HDF

Run docker run --rm -w /share -v$(pwd):/share mitre/saf view summary -i /share/hdf-results.json
##[debug]/usr/bin/bash --noprofile --norc -e -o pipefail /home/runner/work/_temp/638a20ff-3039-4314-8055-155f326f2071.sh
(node:1) [ENOENT] Error Plugin: @mitre/saf: ENOENT: no such file or directory, open '/share/hdf-results.json'
module: @oclif/[email protected]
task: toCached

plugin: @mitre/saf
root: /usr/local/lib/node_modules/@mitre/saf
See more details with DEBUG=*

3. Opening fails due to invalid file name,
   i have added upload of workspace so you can see
   The result of attached action is workspace with file hdf-results-.json which contains addtional character '-'

[Amndeep7]

Hi @Jiri-Stary

To make it truly reproducible, I'd appreciate it if you could share the original scan file. It's fine if you anonymize it first so long as it still triggers the same issue you're experiencing.

As a guess, I think the conversion might be behaving strangely since you're attempting to run the snyk converter against a jfrog sample.

Lastly, you might be interested in checking out our github action: https://github.com/mitre/saf_action.

[Jiri-Stary]

Hi @Amndeep7

Sure, let me share the scan file. The reason why i did run it as snyk instead of jfrog was that it did not recognize it at complained that it is a snyk file.

I got it actually by scanning a docker tar file with jf s image.tar
sample_jfrog.zip

I am unable to run the github action, since it is not coming from a verified creator