Skip to content

Commit 56c9ca9

Browse files
CatalinSnykCatalinSnyk
committed
feat: add run automation details for SARIF output
1 parent a5d3f0b commit 56c9ca9

File tree

8 files changed

+75
-21
lines changed

8 files changed

+75
-21
lines changed

‎cliv2/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ require (
1818
github.com/snyk/cli-extension-sbom v0.0.0-20250801142135-ae472dafa4cd
1919
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
2020
github.com/snyk/error-catalog-golang-public v0.0.0-20250912144134-a308b7983895
21-
github.com/snyk/go-application-framework v0.0.0-20250917164002-527eabced057
21+
github.com/snyk/go-application-framework v0.0.0-20250922075509-bb6458741916
2222
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65
2323
github.com/snyk/snyk-iac-capture v0.6.5
2424
github.com/snyk/snyk-ls v0.0.0-20250911124327-66ea5253a18c

‎cliv2/go.sum‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1266,10 +1266,13 @@ github.com/snyk/code-client-go v1.23.4 h1:GDvWVIEqSeAvuv43AMMGFARzpnolXqw0kMiyf4
12661266
github.com/snyk/code-client-go v1.23.4/go.mod h1:3d9rtr06j239obFmF7Ojl9KybivOTR3lz0vsmDNPsRI=
12671267
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7 h1:/2+2piwQtB9fEJCkXEOjboZjY+77lQfnvqBZ/60xNHk=
12681268
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7/go.mod h1:38w+dcAQp9eG3P5t2eNS9eG0reut10AeJjLv5lJ5lpM=
1269-
github.com/snyk/error-catalog-golang-public v0.0.0-20250912144134-a308b7983895 h1:JrN/uGEMVprlres/CVMJybSKvaLuW59SfCHoT4TfvUk=
1269+
github.com/snyk/error-catalog-golang-public v0.0.0-20250812140843-a01d75260003 h1:qeXih9sVe/WvhccE3MfEgglnSVKN1xTQBcsA/N96Kzo=
1270+
github.com/snyk/error-catalog-golang-public v0.0.0-20250812140843-a01d75260003/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
12701271
github.com/snyk/error-catalog-golang-public v0.0.0-20250912144134-a308b7983895/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
1271-
github.com/snyk/go-application-framework v0.0.0-20250917164002-527eabced057 h1:Hh6NV/bhfXaiurUHFSUSqInZ1bHecqQeHKoyKff3+tY=
1272-
github.com/snyk/go-application-framework v0.0.0-20250917164002-527eabced057/go.mod h1:3qfDCCm6WiRb0xfX0fXlBS1sVbAbEsaCPeHEns/QVcA=
1272+
github.com/snyk/go-application-framework v0.0.0-20250917075126-86da42c27dae h1:48Z3TfXoPllIvFogEXvzX7klFbhXTCIgvu9J7i/92LE=
1273+
github.com/snyk/go-application-framework v0.0.0-20250917075126-86da42c27dae/go.mod h1:3qfDCCm6WiRb0xfX0fXlBS1sVbAbEsaCPeHEns/QVcA=
1274+
github.com/snyk/go-application-framework v0.0.0-20250922075509-bb6458741916 h1:vnaIcja//5/DTlQi8SMbx9RAGt9A295Dv5+q3IMA7FM=
1275+
github.com/snyk/go-application-framework v0.0.0-20250922075509-bb6458741916/go.mod h1:3qfDCCm6WiRb0xfX0fXlBS1sVbAbEsaCPeHEns/QVcA=
12731276
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65 h1:CEQuYv0Go6MEyRCD3YjLYM2u3Oxkx8GpCpFBd4rUTUk=
12741277
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65/go.mod h1:88KbbvGYlmLgee4OcQ19yr0bNpXpOr2kciOthaSzCAg=
12751278
github.com/snyk/policy-engine v1.1.0 h1:vFbFZbs3B0Y3XuGSur5om2meo4JEcCaKfNzshZFGOUs=

‎src/lib/formatters/iac-output/sarif.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ export function createSarifOutputForIac(
6060
rules: extractReportingDescriptor(issues),
6161
},
6262
};
63+
64+
const projectName = iacTestResponses[0].projectName;
65+
const projectIdentifier = projectName ? `${projectName}/` : '';
66+
6367
return {
6468
$schema:
6569
'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json',
@@ -78,7 +82,7 @@ export function createSarifOutputForIac(
7882

7983
tool,
8084
automationDetails: {
81-
id: 'snyk-iac',
85+
id: `Snyk/IaC/${projectIdentifier}${new Date().toISOString()}`,
8286
},
8387
results: mapIacTestResponseToSarifResults(issues),
8488
},

‎src/lib/formatters/open-source-sarif-output.ts‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,21 +26,29 @@ export function createSarifOutputForOpenSource(
2626
$schema:
2727
'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json',
2828
version: '2.1.0',
29-
runs: testResults.map(replaceLockfileWithManifest).map((testResult) => ({
30-
tool: {
31-
driver: {
32-
name: 'Snyk Open Source',
33-
semanticVersion: getVersion(),
34-
version: getVersion(),
35-
informationUri: 'https://docs.snyk.io/',
36-
properties: {
37-
artifactsScanned: testResult.dependencyCount,
29+
runs: testResults.map(replaceLockfileWithManifest).map((testResult) => {
30+
const projectName = testResult?.projectName;
31+
const projectIdentifier = projectName ? `${projectName}/` : '';
32+
33+
return {
34+
tool: {
35+
driver: {
36+
name: 'Snyk Open Source',
37+
semanticVersion: getVersion(),
38+
version: getVersion(),
39+
informationUri: 'https://docs.snyk.io/',
40+
properties: {
41+
artifactsScanned: testResult.dependencyCount,
42+
},
43+
rules: getRules(testResult),
3844
},
39-
rules: getRules(testResult),
4045
},
41-
},
42-
results: getResults(testResult),
43-
})),
46+
automationDetails: {
47+
id: `Snyk/Open Source/${projectIdentifier}${new Date().toISOString()}`,
48+
},
49+
results: getResults(testResult),
50+
};
51+
}),
4452
};
4553
}
4654

‎src/lib/formatters/sarif-output.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,15 @@ export function createSarifOutputForContainers(
1616
};
1717

1818
testResults.forEach((testResult) => {
19+
const projectName = testResult?.projectName;
20+
const projectIdentifier = projectName ? `${projectName}/` : '';
21+
1922
sarifRes.runs.push({
2023
tool: getTool(testResult),
2124
results: getResults(testResult),
25+
automationDetails: {
26+
id: `Snyk/Container/${projectIdentifier}${new Date().toISOString()}`,
27+
},
2228
});
2329
});
2430

‎src/lib/iac/test/v2/sarif.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ export function convertEngineToSarifResults(scanResult: TestOutput): sarif.Log {
3131
},
3232
};
3333

34+
const projectName = scanResult.results?.metadata?.projectName;
35+
const projectIdentifier = projectName ? `${projectName}/` : '';
36+
3437
return {
3538
$schema:
3639
'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
@@ -49,7 +52,7 @@ export function convertEngineToSarifResults(scanResult: TestOutput): sarif.Log {
4952

5053
tool,
5154
automationDetails: {
52-
id: 'snyk-iac',
55+
id: `Snyk/IaC/${projectIdentifier}${new Date().toISOString()}`,
5356
},
5457
results: mapSnykIacTestResultsToSarifResults(scanResult.results),
5558
},

‎src/lib/plugins/sast/analysis.ts‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,12 +121,31 @@ export async function getCodeTestResults(
121121
return null;
122122
}
123123

124+
enrichCodeAnalysis(codeAnalysis, config.PROJECT_NAME);
125+
124126
return {
125127
reportResults: codeAnalysis.reportResults,
126128
analysisResults: codeAnalysis.analysisResults,
127129
};
128130
}
129131

132+
function enrichCodeAnalysis(
133+
codeAnalysis: CodeAnalysisResults,
134+
projectName: string,
135+
): void {
136+
// Overrides the schema link to the work
137+
codeAnalysis.analysisResults.sarif.$schema =
138+
'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json';
139+
140+
const projectIdentifier = projectName ? `${projectName}/` : '';
141+
if (codeAnalysis.analysisResults.sarif.runs[0]) {
142+
codeAnalysis.analysisResults.sarif.runs[0].automationDetails = {
143+
id: `Snyk/Code/${projectIdentifier}${new Date().toISOString()}`,
144+
...codeAnalysis.analysisResults.sarif.runs[0].automationDetails,
145+
};
146+
}
147+
}
148+
130149
/**
131150
* Performs Code analysis and returns normalised results.
132151
* Analysis method (i.e. file-based or SCM) is chosen based on flow options.
@@ -249,8 +268,6 @@ function parseSecurityResults(codeAnalysis: Log): Log {
249268
);
250269
}
251270

252-
codeAnalysis.$schema =
253-
'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json';
254271
return codeAnalysis;
255272
}
256273

‎test/jest/acceptance/cli-sarif-output.spec.ts‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,3 +90,16 @@ describe('SARIF output is schema compliant', () => {
9090
expect(jsonValidator.validate(schema, result)).toBe(true);
9191
});
9292
});
93+
94+
describe('SARIF output is GitHub Actions compliant', () => {
95+
it.each(TEST_CASES)(
96+
'has runAutomationDetails.id for $name',
97+
async ({ cmd, env, target }: TestCase) => {
98+
const { stdout, code } = await runSnykCLI(`${cmd} ${target}`, { env });
99+
expect(code).toBe(1);
100+
101+
const result = JSON.parse(stdout);
102+
expect(result.runs[0].automationDetails.id).toMatch(/Snyk\/[A-Z][a-z]+/);
103+
},
104+
);
105+
});

0 commit comments

Comments
 (0)