mirrors/zizmor
1
0
Fork 0
mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

bugfix: sarif: prefix ID, add rule names (#710)

Browse source
This commit is contained in:
William Woodruff 2025-04-29 10:29:16 -04:00 • committed by GitHub
parent 9cd012b752
commit 27f820c7b9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/release-notes.md
View file

@ -15,6 +15,15 @@ of `zizmor`.
GitHub Actions usages. These patterns are not themselves dangerous,
but may indicate an attempt to obscure malicious behavior (#683)
### Bug Fixes 🐛
* The SARIF output format now uses `zizmor/{id}` for rule IDs instead
of bare IDs, reducing the chance of conflict or confusion with other tools
(#710)
* The SARIF output format now includes a rule name for each rule descriptor,
which should improve rendering behavior in SARIF viewers like the
VS Code SARIF Viewer extension (#710)
## v1.6.0
### New Features 🌈

5
src/output/sarif.rs
View file

@ -80,7 +80,8 @@ fn build_rules(findings: &[Finding]) -> Vec<ReportingDescriptor> {
fn build_rule(finding: &Finding) -> ReportingDescriptor {
ReportingDescriptor::builder()
.id(finding.ident)
.id(format!("zizmor/{id}", id = finding.ident))
.name(finding.ident)
.help_uri(finding.url)
.help(
MultiformatMessageString::builder()
@ -104,7 +105,7 @@ fn build_result(finding: &Finding<'_>) -> SarifResult {
.unwrap();
SarifResult::builder()
.rule_id(finding.ident)
.rule_id(format!("zizmor/{id}", id = finding.ident))
// NOTE: We use the primary location's annotation for the result's message.
// This is conceptually incorrect since the location's annotation should
// only be on the location itself. However, GitHub's SARIF viewer does not