Let the users set the path for the config file.

README.md

@@ -72,14 +72,13 @@ or by inlining this option in your workflow file.
 
 #### config-file
 
-**TODO**: Change this to be a user-configured string.
+A string representing the path to an external configuraton file. By
+default external configuration files are not used.
 
-Defaults to `false`. Configure whether an external configuration file
-will be used.
+**Possible values**: A string representing the absolute path to the
+  configuration file.
 
-**Possible values**: `true`, `false`.
-
-**Example**: `config-file: true`.
+**Example**: `config-file: ./.github/dependency-review-config.yml`.
 
 #### fail-on-severity
 
@@ -149,13 +148,10 @@ file:
 - name: Dependency Review
   uses: actions/dependency-review-action@v2
   with:
-    config-file: true
+    config-file: "./.github/dependency-review-config.yml"
 ```
 
-**TODO**: Users should be able to provide a string for their config paths.
-
-And then create the configuration file in
-`~/.github/dependency-review-config.yaml`. **All of these fields are
+And then create the file in the path you just specified. **All of these fields are
 optional**:
 
 ```yaml

__tests__/config.test.ts

@@ -95,15 +95,15 @@ test('raises an error when the the config file was not found', async () => {
 })
 
 test('in case of conflicts, the external file is the source of truth', async () => {
-  setInput('config-file', 'true') // this will set fail-on-severity to 'low'
+  setInput('config-file', './__tests__/fixtures/config-allow-sample.yml') // this will set fail-on-severity to 'critical'
 
   let options = readConfig()
-  expect(options.fail_on_severity).toEqual('low')
+  expect(options.fail_on_severity).toEqual('critical')
 
   // this should not overwite the previous value
-  setInput('fail-on-severity', 'critical')
+  setInput('fail-on-severity', 'lowl')
   options = readConfig()
-  expect(options.fail_on_severity).toEqual('low')
+  expect(options.fail_on_severity).toEqual('critical')
 })
 
 test('it accepts an external configuration filename', async () => {

action.yml

@@ -16,6 +16,9 @@ inputs:
   head-ref:
     description: The head git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise.
     required: false
+  config-file:
+    description: A filepath to the configuration file for the action.
+    required: false
   allow-licenses:
     description: Comma-separated list of allowed licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")
     required: false

src/config.ts

@@ -5,17 +5,15 @@ import * as core from '@actions/core'
 import * as z from 'zod'
 import {ConfigurationOptions, SEVERITIES} from './schemas'
 
-export const CONFIG_FILEPATH = './.github/dependency-review-config.yml'
-
 function getOptionalInput(name: string): string | undefined {
   const value = core.getInput(name)
   return value.length > 0 ? value : undefined
 }
 
 export function readConfig(): ConfigurationOptions {
-  const hasExternalConfig = getOptionalInput('config-file')
-  if (hasExternalConfig !== undefined) {
-    return readConfigFile(CONFIG_FILEPATH)
+  const externalConfig = getOptionalInput('config-file')
+  if (externalConfig !== undefined) {
+    return readConfigFile(externalConfig)
   } else {
     return readInlineConfig()
   }
@@ -45,9 +43,7 @@ export function readInlineConfig(): ConfigurationOptions {
   }
 }
 
-export function readConfigFile(
-  filePath: string = CONFIG_FILEPATH
-): ConfigurationOptions {
+export function readConfigFile(filePath: string): ConfigurationOptions {
   let data
 
   try {