Fix SARIF validation errors for GitHub CodeQL upload #384

Copilot · 2026-01-09T13:33:55Z

Summary

Fixed the SARIF validation errors by making minimal changes to formatters/sarif/sarif.go:

Set index to 0 on ToolComponentReference (points to first taxonomy)
Set guid to a valid UUID to avoid null serialization
Initialize Rules field as empty array []

Added comprehensive tests including:

TestSarifFormat: Validates general SARIF structure
TestSarifFormatIssue384: Scans the actual workflow YAML from issue Fix SARIF validation errors for GitHub CodeQL upload #384 using InventoryScanner and OPA analysis to validate the fix works with real data

Original prompt

This section details on the original issue you should resolve

<issue_title>Error: Unable to upload "results.sarif" as it is not valid SARIF</issue_title>
<issue_description>Describe the bug

When the GitHub Action job reaches the SARIF upload step, the SARIF upload fails.

Error: Unable to upload "results.sarif" as it is not valid SARIF:

instance.runs[0].tool.driver.supportedTaxonomies[0].index is not of a type(s) integer
instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string
instance.runs[0].taxonomies[0].rules is not of a type(s) array

To Reproduce

Here is our job YAML. Notice we run on a https://runs-on.com/ GitHub runner, on Ubuntu 24.04.

  poutine:
    name: Boost Security.io Poutine
    runs-on:
      # these are auto-generated
      - runs-on=${{ github.run_id }}
      - runner=default_ubuntu_24_arm64
      - env=${{ vars.RUNS_ON_ENV_DEV }}/region=us-east-1

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - name: Setup self-hosted runner
        uses: coveo-platform/setup-runner@v1.0.0
      - uses: actions/checkout@v5.0.0
      - name: poutine - GitHub Actions SAST
        uses: boostsecurityio/poutine-action@61bf0017ee5853beb601609f85c94249b53c26ef
      - name: Upload poutine SARIF file
        uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
        with:
          sarif_file: results.sarif

Expected behavior
Uploading a SARIF normally works.

Screenshots

Run github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f
##[debug]Sending status report: {"action_name":"upload-sarif","action_oid":"unknown","action_ref":"4fa2a7953630fd2f3fb380f21be14ede0169dd4f","action_started_at":"2025-11-07T18:05:39.980Z","action_version":"3.25.12","analysis_key":".github/workflows/security-ci.yml:poutine","commit_oid":"fcd6c2d5b2c2d8366e13b7415780831017e0ecae","first_party_analysis":false,"job_name":"poutine","job_run_uuid":"","ref":"refs/pull/482/merge","runner_os":"Linux","started_at":"2025-11-07T18:05:39.980Z","status":"starting","steady_state_default_setup":false,"testing_environment":"","workflow_name":"Code Scanning","workflow_run_attempt":2,"workflow_run_id":19173891048,"actions_event_name":"pull_request","runner_available_disk_space_bytes":40131665920,"runner_total_disk_space_bytes":50884108288,"matrix_vars":"null","runner_arch":"ARM64"}
::group::Uploading results
Uploading results
Error details: instance.runs[0].tool.driver.supportedTaxonomies[0].index is not of a type(s) integer
::group::Error details: instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string
Error details: instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string
::group::Error details: instance.runs[0].taxonomies[0].rules is not of a type(s) array
Error details: instance.runs[0].taxonomies[0].rules is not of a type(s) array
Error: Unable to upload "results.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.supportedTaxonomies[0].index is not of a type(s) integer
- instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string
- instance.runs[0].taxonomies[0].rules is not of a type(s) array
##[debug]Sending status report: {"action_name":"upload-sarif","action_oid":"unknown","action_ref":"4fa2a7953630fd2f3fb380f21be14ede0169dd4f","action_started_at":"2025-11-07T18:05:39.980Z","action_version":"3.25.12","analysis_key":".github/workflows/security-ci.yml:poutine","commit_oid":"fcd6c2d5b2c2d8366e13b7415780831017e0ecae","first_party_analysis":false,"job_name":"poutine","job_run_uuid":"","ref":"refs/pull/482/merge","runner_os":"Linux","started_at":"2025-11-07T18:05:39.980Z","status":"user-error","steady_state_default_setup":false,"testing_environment":"","workflow_name":"Code Scanning","workflow_run_attempt":2,"workflow_run_id":19173891048,"actions_event_name":"pull_request","runner_available_disk_space_bytes":40131641344,"runner_total_disk_space_bytes":50884108288,"cause":"Unable to upload \"results.sarif\" as it is not valid SARIF:\n- instance.runs[0].tool.driver.supportedTaxonomies[0].index is not of a type(s) integer\n- instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string\n- instance.runs[0].taxonomies[0].rules is not of a type(s) array","exception":"Error: Unable to upload \"results.sarif\" as it is not valid SARIF:\n- instance.runs[0].tool.driver.supportedTaxonomies[0].index is not of a type(s) integer\n- instance.runs[0].tool.driver.supportedTaxonomies[0].guid is not of a type(s) string\n- instance.runs[0].taxonomies[0].rules is not of a type(s) array\n    at run (/home/runner/_work/_actions/github/codeql-action/4fa2a7953630fd2f3fb380f21be14ede0169dd4f/lib/upload-sarif-action.js:73:15)\n    at...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes boostsecurityio/poutine#379

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

- Set index property on ToolComponentReference to 0 (pointing to first taxonomy) - Set guid property to avoid null serialization - Initialize Rules field in ToolComponent as empty array instead of null - Add comprehensive test case to validate SARIF structure Co-authored-by: fproulx-boostsecurity <76956526+fproulx-boostsecurity@users.noreply.github.com>

fproulx-boostsecurity · 2026-01-09T14:08:52Z

@copilot explicitely add a test case to confirms that what was reported in issue #384 is fixed (create a test fixture with the exact YAML given by the reporter)

i.e.

  poutine:
    name: Boost Security.io Poutine
    runs-on:
      # these are auto-generated
      - runs-on=${{ github.run_id }}
      - runner=default_ubuntu_24_arm64
      - env=${{ vars.RUNS_ON_ENV_DEV }}/region=us-east-1

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - name: Setup self-hosted runner
        uses: coveo-platform/setup-runner@v1.0.0
      - uses: actions/checkout@v5.0.0
      - name: poutine - GitHub Actions SAST
        uses: boostsecurityio/poutine-action@61bf0017ee5853beb601609f85c94249b53c26ef
      - name: Upload poutine SARIF file
        uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
        with:
          sarif_file: results.sarif

- Replace require.Equal with require.InDelta for float comparison to fix testifylint error - Add test fixture with exact YAML from issue #384 - Add comprehensive test case TestSarifFormatIssue384 to validate the fix Co-authored-by: fproulx-boostsecurity <76956526+fproulx-boostsecurity@users.noreply.github.com>

Copilot · 2026-01-09T14:13:36Z

@copilot explicitely add a test case to confirms that what was reported in issue #384 is fixed (create a test fixture with the exact YAML given by the reporter)

i.e.
...

Added test fixture with the exact YAML from issue #384 at formatters/sarif/testdata/.github/workflows/issue-384.yml and created TestSarifFormatIssue384 test case that validates all three fields that caused the validation errors. Also fixed the linting error by replacing require.Equal with require.InDelta for float comparison. Commit: 3d7c208

fproulx-boostsecurity · 2026-01-09T14:26:21Z

@copilot you added formatters/sarif/testdata/.github/workflows/issue-384.yml test fixture, but I'm convinced the test suite actually uses that new file

- Modified TestSarifFormatIssue384 to use InventoryScanner to scan the testdata directory - Test now parses the actual workflow file and runs OPA analysis to generate findings - Added imports for scanner and opa packages - Test validates that issue-384.yml workflow is found and scanned - SARIF output is generated from real scan results instead of mock data Co-authored-by: fproulx-boostsecurity <76956526+fproulx-boostsecurity@users.noreply.github.com>

Copilot · 2026-01-09T14:31:11Z

@copilot you added formatters/sarif/testdata/.github/workflows/issue-384.yml test fixture, but I'm convinced the test suite actually uses that new file

You were correct - the test was only referencing the file path in mock data. Updated TestSarifFormatIssue384 to actually scan the testdata directory using InventoryScanner and run OPA analysis on the real workflow file. The test now verifies that issue-384.yml is found, parsed, analyzed, and the SARIF output is generated from actual scan results. Commit: 8fe5538

Initial plan

cb95c3f

Copilot AI assigned Copilot and fproulx-boostsecurity Jan 9, 2026

Copilot started work on behalf of fproulx-boostsecurity January 9, 2026 13:34 View session

Copilot AI changed the title ~~[WIP] Fix invalid SARIF upload error in GitHub Action~~ Fix SARIF validation errors for GitHub CodeQL upload Jan 9, 2026

Copilot AI requested a review from fproulx-boostsecurity January 9, 2026 13:47

Copilot finished work on behalf of fproulx-boostsecurity January 9, 2026 13:47

fproulx-boostsecurity marked this pull request as ready for review January 9, 2026 14:05

fproulx-boostsecurity requested a review from a team as a code owner January 9, 2026 14:05

fproulx-boostsecurity requested a review from SUSTAPLE117 January 9, 2026 14:06

Copilot started work on behalf of fproulx-boostsecurity January 9, 2026 14:09 View session

Copilot finished work on behalf of fproulx-boostsecurity January 9, 2026 14:14

Copilot started work on behalf of fproulx-boostsecurity January 9, 2026 14:26 View session

SUSTAPLE117 previously approved these changes Jan 9, 2026

View reviewed changes

Copilot AI dismissed SUSTAPLE117’s stale review via 8fe5538 January 9, 2026 14:30

Copilot finished work on behalf of fproulx-boostsecurity January 9, 2026 14:31

fproulx-boostsecurity requested a review from SUSTAPLE117 January 9, 2026 14:45

fproulx-boostsecurity approved these changes Jan 9, 2026

View reviewed changes

SUSTAPLE117 approved these changes Jan 9, 2026

View reviewed changes

fproulx-boostsecurity merged commit a6900f5 into main Jan 9, 2026
11 checks passed

fproulx-boostsecurity deleted the copilot/fix-sarif-upload-error branch January 9, 2026 14:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix SARIF validation errors for GitHub CodeQL upload #384

Fix SARIF validation errors for GitHub CodeQL upload #384

Uh oh!

Copilot AI commented Jan 9, 2026 •

edited

Loading

Uh oh!

fproulx-boostsecurity commented Jan 9, 2026

Uh oh!

Copilot AI commented Jan 9, 2026

Uh oh!

fproulx-boostsecurity commented Jan 9, 2026

Uh oh!

Copilot AI commented Jan 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix SARIF validation errors for GitHub CodeQL upload #384

Fix SARIF validation errors for GitHub CodeQL upload #384

Uh oh!

Conversation

Copilot AI commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

fproulx-boostsecurity commented Jan 9, 2026

Uh oh!

Copilot AI commented Jan 9, 2026

Uh oh!

fproulx-boostsecurity commented Jan 9, 2026

Uh oh!

Copilot AI commented Jan 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 9, 2026 •

edited

Loading