allow filtering controls

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

README.md

@@ -68,6 +68,17 @@ verifier:
   output: path/to/results/%{platform}_%{suite}_inspec.xml
 ```
 
+You can also decide to only run specific controls, instead of a full profile. This is done by specifying a list of controls:
+
+```
+verifier:
+  name: inspec
+  controls:
+    - control-id1
+    - control-id4
+    ...
+```
+
 ### Directory Structure
 
 By default `kitchen-inspec` expects test to be in `test/integration/%suite%` directory structure (we use Chef as provisioner here):

lib/kitchen/verifier/inspec.rb

@@ -186,6 +186,7 @@ def runner_options(transport, state = {}, platform = nil, suite = nil) # rubocop
           runner_options["format"] = config[:format] unless config[:format].nil?
           runner_options["output"] = config[:output] % { platform: platform, suite: suite } unless config[:output].nil?
           runner_options["profiles_path"] = config[:profiles_path] unless config[:profiles_path].nil?
+          runner_options["controls"] = config[:controls]
         end
       end
 

spec/kitchen/verifier/inspec_spec.rb

@@ -203,6 +203,20 @@
       verifier.call(port: 123)
     end
 
+    it "constructs an Inspec::Runner with a controls filter" do
+      config[:controls] = %w{a control}
+
+      expect(Inspec::Runner).to receive(:new)
+        .with(
+          hash_including(
+            "controls" => %w{a control}
+          )
+        )
+        .and_return(runner)
+
+      verifier.call(port: 123)
+    end
+
     it "provide platform and test suite to build output path" do
       allow(Inspec::Runner).to receive(:new).and_return(runner)