feature: add sarif output (GitHub Code Scan)

[blackheaven]

No description provided.

[MangoIV]

Nice!

Some minor nitpicks, feel free to ignore. I think I will try this out locally and if I'm happy, we can merge.

If you don't want to apply the nitpicks yourself, I will just do that in a follow up PR, myself.

Thank you so much for you contribution!

[MangoIV]

Maybe it would also be nice to add the output of these Sarif things as an additional step to CI such that we can inspect them etc. :)

[blackheaven]

Maybe it would also be nice to add the output of these Sarif things as an additional step to CI such that we can inspect them etc. :)

yes, I was forced to it for debugging purposes.

[MangoIV]

I also just realized I'm too fucking stupid to set up my flake checks properly, so I will definitely have to add a fourmolu step after this gets merged 👀

[MangoIV]

if you already have this PR tested somewhere together with your action, perhaps you can leave a link to it?

[blackheaven]

I also just realized I'm too fucking stupid to set up my flake checks properly, so I will definitely have to add a fourmolu step after this gets merged 👀

I have reformatted the file

if you already have this PR tested somewhere together with your action, perhaps you can leave a link to it?

not yet

[blackheaven]

I have changed my GitHub Action: https://github.com/blackheaven/haskell-security-action/blob/master/action.yaml#L34

It works great: https://github.com/blackheaven/vulnerable-sandbox/actions/runs/10696473443

[MangoIV]

Nice! can you perhaps tell me how this would work then? i.e. where would I see the security report - I see there's some upload happening?

[MangoIV]

(sorry, I'm new to this, I don't know how this github security / sarif thing works)

[MangoIV]

I really like what you did wrt formatting, btw. I think we can merge today :)

[blackheaven]

Here they are: https://github.com/blackheaven/vulnerable-sandbox/security/code-scanning

[MangoIV]

Here they are: https://github.com/blackheaven/vulnerable-sandbox/security/code-scanning

that explains it - I don't have access to this tab - I guess kinda understandable... :)

[MangoIV]

this is how it looks on my fork - seems to work!

[MangoIV]

thank you so much, huge improvement to the tool!