add scancodeio-extra-packages option for extra packages

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

README.md

@@ -25,6 +25,7 @@ from your **GitHub Workflows**.
   - [Check for compliance issues](#check-for-compliance-issues)
   - [Define a custom project name](#define-a-custom-project-name)
   - [Use a specific ScanCode.io Docker image](#use-a-specific-scancodeio-docker-image)
+  - [Install extra Python packages in the image](#install-extra-python-packages-in-the-image)
   - [Run source to binary mapping](#run-source-to-binary-mapping)
 - [Where does the scan results go?](#where-are-the-scan-results)
 
@@ -87,6 +88,10 @@ steps:
 
     # ScanCode.io Docker image to use.
     scancodeio-image:
+
+    # Extra Python packages to install on top of the ScanCode.io image
+    # (comma-separated, e.g. minecode-pipelines).
+    scancodeio-extra-packages:
 ```
 
 ## Examples
@@ -230,6 +235,20 @@ against the latest `main` build:
     scancodeio-image: "ghcr.io/aboutcode-org/scancode.io:main"
 ```
 
+### Install extra Python packages in the image
+
+To run pipelines that are not part of the base image, such as `minecode_pipelines`
+for PURL mining, provide the packages to install via `scancodeio-extra-packages`.
+The action builds a local, throwaway image on top of `scancodeio-image` for this
+run only:
+
+```yaml
+- uses: aboutcode-org/scancode-action@beta
+  with:
+    pipelines: "mine_pypi"
+    scancodeio-extra-packages: "minecode-pipelines"
+```
+
 ### Run source to binary mapping
 
 Use this [workflow template](.github/workflows/map-deploy-to-develop-template.yml) for validating the integrity of open-source binary. It compares a project’s binary to its source code. Workflow will generate mapping between compiled binary and its original source code, which helps in spotting any malicious, unexpected, or otherwise undesirable code that may have made its way into the final binary.

action.yml

@@ -40,6 +40,10 @@ inputs:
   scancodeio-image:
     description: "ScanCode.io Docker image to use."
     default: "ghcr.io/aboutcode-org/scancode.io@sha256:6fc8023bc588602ef2ec2b699c2503d8771fe5ef16470475fe64b641f0955f5b"  # v37.1.0
+  scancodeio-extra-packages:
+    description: "Extra Python packages to install on top of the ScanCode.io image (comma-separated, e.g. minecode-pipelines) (optional)."
+    required: false
+    default: ""
 
 runs:
   using: "composite"
@@ -51,13 +55,20 @@ runs:
         INPUT_PROJECT_NAME: ${{ inputs.project-name }}
         INPUT_FAIL_LEVEL: ${{ inputs.compliance-fail-level }}
         INPUT_PIPELINES: ${{ inputs.pipelines }}
+        INPUT_EXTRA_PACKAGES: ${{ inputs.scancodeio-extra-packages }}
       run: |
         # Docker image ref: registry/name:tag or registry/name@sha256:digest
         if [[ ! "$INPUT_IMAGE" =~ ^[a-zA-Z0-9./_:@-]+$ ]]; then
           echo "::error::Invalid image name: $INPUT_IMAGE"
           exit 1
         fi
 
+        # Extra packages: pip requirement specifiers, comma-separated
+        if [[ ! "$INPUT_EXTRA_PACKAGES" =~ ^[]a-zA-Z0-9._,\<\>=!~[\ -]*$ ]]; then
+          echo "::error::Invalid scancodeio-extra-packages value: $INPUT_EXTRA_PACKAGES"
+          exit 1
+        fi
+
         # Project name: alphanumeric, spaces, hyphens, underscores, dots
         if [[ ! "$INPUT_PROJECT_NAME" =~ ^[a-zA-Z0-9[:space:]._-]+$ ]]; then
           echo "::error::Invalid project name: $INPUT_PROJECT_NAME"
@@ -89,6 +100,19 @@ runs:
         # Sanitize project name for artifact usage
         echo "SAFE_PROJECT_NAME=${INPUT_PROJECT_NAME//[^a-zA-Z0-9._-]/_}" >> "$GITHUB_ENV"
 
+    - name: Build image with extra packages
+      if: ${{ inputs.scancodeio-extra-packages != '' }}
+      shell: bash
+      env:
+        INPUT_EXTRA_PACKAGES: ${{ inputs.scancodeio-extra-packages }}
+      run: |
+        EXTENDED_IMAGE="scancode-action-extended:${GITHUB_RUN_ID}-${GITHUB_JOB}"
+        docker build -t "$EXTENDED_IMAGE" - <<EOF
+        FROM $SCANCODEIO_IMAGE
+        RUN pip install --no-cache-dir ${INPUT_EXTRA_PACKAGES//,/ }
+        EOF
+        echo "SCANCODEIO_IMAGE=$EXTENDED_IMAGE" >> "$GITHUB_ENV"
+
     - name: Start and setup the PostgreSQL service
       shell: bash
       run: |