Skip to content

Conversation

PeterSchafer
Copy link
Contributor

Pull Request Submission Checklist

  • Follows CONTRIBUTING guidelines
  • Commit messages
    are release-note ready, emphasizing
    what was changed, not how.
  • Includes detailed description of changes
  • Contains risk assessment (Low | Medium | High)
  • Highlights breaking API changes (if applicable)
  • Links to automated tests covering new functionality
  • Includes manual testing instructions (if necessary)
  • Updates relevant GitBook documentation (PR link: ___)
  • Includes product update to be announced in the next stable release notes

What does this PR do?

This PR adds missing property metadata to the Sarif Output of the golang native code test implementation, which is used with CCI. This change affects only users of snyk code test --report that are accessing the uploadResult property in the Sarif output.

Where should the reviewer start?

  1. chore: add project and snapshot as resultmetadata code-client-go#118
  2. chore: forward project and snapshot id to local findings go-application-framework#428

How should this be manually tested?

By running the following command

snyk code test --report --project-name=SomeName --sarif-file-output=sarif.json

In the resulting sarif.json the run must contain a property called uploadResult with reportUrl, snapshotId, projectId.

What's the product update that needs to be communicated to CLI users?

This changes fixes a regression between legacy code test and a new implementation, where reportUrl and other metadata was missing in the sarif output.

Risk assessment (Low | Medium | High)?

Low

@PeterSchafer PeterSchafer requested review from a team as code owners September 17, 2025 10:49
Copy link

snyk-io bot commented Sep 17, 2025

🎉 Snyk checks have passed. No issues have been found so far.

security/snyk check is complete. No issues have been found. (View Details)

license/snyk check is complete. No issues have been found. (View Details)

code/snyk check is complete. No issues have been found. (View Details)

@PeterSchafer PeterSchafer force-pushed the fix/CLI-1045_report_sarif branch from d1e7203 to 693e548 Compare September 17, 2025 10:50
@PeterSchafer PeterSchafer changed the base branch from main to release-candidate September 17, 2025 13:55
Copy link
Contributor

Warnings
⚠️

Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones.
A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax.
Files found:

  • test/jest/acceptance/snyk-code/snyk-code-user-journey.spec.ts
⚠️ There are multiple commits on your branch, please squash them locally before merging!
⚠️

"fix(code): Add missing report metadata to sarif output when using CCI or code test native" is too long. Keep the first line of your commit message under 72 characters.

⚠️

"fix(cicd): "gobject-introspection: no bottle available" error when setting up macos acceptance tests" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 5ff0528

@PeterSchafer PeterSchafer merged commit 387fa0b into release-candidate Sep 22, 2025
7 checks passed
@PeterSchafer PeterSchafer deleted the fix/CLI-1045_report_sarif branch September 22, 2025 11:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants