Command should write SAST report to ANALYZER_ARTIFACT_DIR if one is specified

When using an analyzer that uses the latest version of command, that analyzer will write the gl-sast-report.json to the current working directory, ignoring the flag specified in env var ANALYZER_ARTIFACT_DIR or --artifact-dir command line.

This presumably happen after 2.13.4, when the common package is ported to command package but the old logic is not migrated.

The fix could be adding back support for flagArtifactDir in run.go, like:

artifactPath := filepath.Join(root, c.String(flagArtifactDir), artifactName)

Suggested Workaround

It's possible to use after_script to copy the resulting json file to the desired location . One could define a global after_script that will apply to all SAST jobs to support this use case.

.sast:
  after_script:
     - 'cp gl-sast-report.json $ANALYZER_ARTIFACT_DIR'