Corrige les workflows d'analyse de sécurité#95
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR introduces a SARIF splitting utility for multi-run security scan results and updates two CI workflows. The new Python script splits SARIF files into per-run outputs with deterministic naming, integrated into Codacy's workflow. OSSAR workflow receives environment stabilization: pinned Windows runner, explicit .NET SDK 6.0.x installation, and action version upgrade to v2.0.0. ChangesSARIF Splitting Tool and Codacy Integration
OSSAR Workflow Environment and Action Updates
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 11 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new Python script, split_sarif_runs.py, designed to split multi-run SARIF logs into individual files per run to comply with GitHub code scanning requirements. The review feedback focuses on improving the robustness of the JSON parsing and dictionary access. Specifically, it points out potential runtime errors (such as AttributeError and TypeError) that could occur if optional keys like tool, driver, or automationDetails are explicitly set to null in the input SARIF file, or if the JSON root is a list instead of an object. Code suggestions were provided to safely handle these edge cases.
| def tool_name(run: dict[str, Any], index: int) -> str: | ||
| driver = run.get("tool", {}).get("driver", {}) | ||
| return str(driver.get("name") or driver.get("semanticVersion") or f"run-{index + 1}") |
There was a problem hiding this comment.
Si la clé "tool" ou "driver" est explicitement définie à null dans le fichier SARIF, run.get("tool", {}) retournera None (car la clé existe mais sa valeur est null). Cela provoquera une erreur AttributeError: 'NoneType' object has no attribute 'get' lors de l'appel suivant.
Pour éviter cela, utilisez l'opérateur or pour vous assurer d'obtenir un dictionnaire par défaut si la valeur est falsy (comme None).
| def tool_name(run: dict[str, Any], index: int) -> str: | |
| driver = run.get("tool", {}).get("driver", {}) | |
| return str(driver.get("name") or driver.get("semanticVersion") or f"run-{index + 1}") | |
| def tool_name(run: dict[str, Any], index: int) -> str: | |
| tool = run.get("tool") or {} | |
| driver = tool.get("driver") or {} | |
| return str(driver.get("name") or driver.get("semanticVersion") or f"run-{index + 1}") |
| sarif = json.loads(input_path.read_text(encoding="utf-8")) | ||
| runs = sarif.get("runs") |
There was a problem hiding this comment.
Si le fichier JSON est valide mais contient un tableau à la racine (par exemple []) au lieu d'un objet, json.loads retournera une list. L'appel sarif.get("runs") lèvera alors une exception AttributeError.
Il est préférable de valider que sarif est bien un dictionnaire avant d'appeler .get().
| sarif = json.loads(input_path.read_text(encoding="utf-8")) | |
| runs = sarif.get("runs") | |
| sarif = json.loads(input_path.read_text(encoding="utf-8")) | |
| if not isinstance(sarif, dict): | |
| raise ValueError(f"{input_path} is not a valid SARIF object") | |
| runs = sarif.get("runs") |
| for index, run in enumerate(runs): | ||
| run_copy = deepcopy(run) | ||
| category = f"{category_prefix}/{index + 1}-{slugify(tool_name(run_copy, index))}" | ||
| run_copy["automationDetails"] = {**run_copy.get("automationDetails", {}), "id": category} |
There was a problem hiding this comment.
De la même manière, si "automationDetails" est explicitement défini à null dans le run SARIF, run_copy.get("automationDetails", {}) retournera None, ce qui provoquera une erreur TypeError: 'NoneType' object is not a mapping lors du dépaquetage {**...}.
Il est plus sûr d'utiliser run_copy.get("automationDetails") or {} pour parer à cette éventualité.
| run_copy["automationDetails"] = {**run_copy.get("automationDetails", {}), "id": category} | |
| automation_details = run_copy.get("automationDetails") or {} | |
| run_copy["automationDetails"] = {**automation_details, "id": category} |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
9 similar comments
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
2 participants
Motivation
runset éviter le rejet GitHub Code Scanning lorsque plusieurs runs partagent la même catégorie.Description
.github/scripts/split_sarif_runs.pyqui découpe un fichier SARIF multi-runsen fichiers SARIF unitaires avec unautomationDetails.iddéterministe et unique..github/workflows/codacy.ymlpour exécuterpython .github/scripts/split_sarif_runs.py results.sarif sarif-results --category-prefix codacyavant l'upload et envoyer le dossiersarif-resultsàgithub/codeql-action/upload-sarif@v4..github/workflows/ossar.ymlpour utiliserruns-on: windows-2022, installer .NET viaactions/setup-dotnet@v5avecdotnet-version: '6.0.x'et pointeruses: github/ossar-action@v2.0.0.Testing
python -m py_compile .github/scripts/split_sarif_runs.py(succès).automationDetails.iduniques (succès).ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f) }' .github/workflows/*.yml(succès).python -m pytest(12 tests, tous réussis).Codex Task