Repository navigation
Add SARIF and GitHub annotation output, and a GitHub Action - #5
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6fa2ae0acc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| # Record the exit code instead of failing here, so the SARIF report is | ||
| # still written and uploaded when the lint finds errors. | ||
| docker-lint "${args[@]}" --format "$FORMAT" "$DOCKERFILE" |
There was a problem hiding this comment.
In the Lint Dockerfile step, GitHub invokes shell: bash with errexit enabled, and set -uo pipefail does not disable -e. Whenever docker-lint returns 1 or 2—the exact cases this action is meant to report—the shell exits here before recording exit-code, generating or uploading SARIF, or reaching Report result; this also makes the failing and fatal cases in .github/workflows/action.yml fail their assertions. Run the command in an if/else or explicitly suspend errexit while capturing its status.
Useful? React with 👍 / 👎.
93d11e7 to
9753750
Compare
Make findings show up where reviewers already look: on the pull request.
Output formats:
- --format selects text, json, sarif or github; --json stays as a
shorthand for --format json and conflicts with any other format.
- sarif writes a SARIF 2.1.0 log for GitHub code scanning. It carries
every rule's metadata (PascalCase name, descriptions, default level,
a category tag from the ID's hundreds digit) and maps severities to
error/warning/note. Relative paths stay relative, which code scanning
resolves against the repository root; absolute ones become file://.
The exit code is unchanged so CI still fails while the report uploads.
- github writes workflow commands that GitHub renders as annotations on
the diff. Code scanning needs GitHub Advanced Security on private
repositories; annotations work everywhere, so they are the action's
default. Values are escaped exactly as @actions/core does.
The formatter package takes rule metadata as input instead of importing
the rules package, so it stays independent of it.
GitHub Action (action.yml, composite):
- Installs a release binary for the runner's OS and architecture with
gh, verifies it against checksums.txt and puts it on PATH. "source"
builds the checkout instead, so the action is testable before any
release exists.
- Records docker-lint's exit code instead of failing at once, writes the
SARIF report, optionally uploads it (codeql-action/upload-sarif@v4),
then fails with the original code. A Dockerfile that cannot be parsed
yields no report rather than an empty one an upload would reject.
- Inputs reach every script through env, never ${{ }} interpolation, so
a crafted input cannot inject shell commands.
- .github/workflows/action.yml runs the action on Linux, macOS and
Windows for a clean, a failing and an unparseable Dockerfile.
Verification:
- SARIF for all 72 analyzable fixtures, plus stdin, quiet and absolute
path cases, validates against the official SARIF 2.1.0 JSON schema.
- The action's scripts were run locally through a harness for the same
scenarios as the workflow. The release-download path, which CI cannot
exercise before a release exists, was run against the GoReleaser
snapshot with a stubbed gh: it resolves the tag, verifies and unpacks
zip and tar.gz archives, and fails on a tampered checksum or a
missing asset.
- New files use the current action majors (checkout v7, setup-go v7,
codeql-action v4), which run on Node 24.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9753750 to
840da89
Compare
GitHub runs composite bash steps with -e, which "set -uo pipefail" does not undo, so a lint failure ended the step before the exit code and the SARIF report were recorded. Capture the exit code with "|| code=$?" instead, and expand the optional arguments safely for bash 3.2 on macOS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stacked on #4 (which is stacked on #3). Retarget to
mainonce those merge;the new
Actionworkflow andrelease-checkonly run on PRs againstmain.Makes findings show up where reviewers already look: on the pull request.
Output formats
--format text|json|sarif|github;--jsonstays as a shorthand.sarif: SARIF 2.1.0 for GitHub code scanning (Security tab, PR alerts),with full rule metadata. Exit codes are unchanged.
github: workflow-command annotations on the PR diff. Code scanning needsGitHub Advanced Security on private repos; annotations work everywhere, so they
are the action's default.
GitHub Action
checksums.txt;version: sourcebuilds the checkout (used by its own tests).exit code. An unparseable Dockerfile yields no report instead of an empty one.
env, never${{ }}interpolation,so crafted inputs cannot inject commands.
Actionworkflow runs it on Linux, macOS and Windows for clean, failingand unparseable Dockerfiles.
Verification
against the official SARIF 2.1.0 JSON schema.
path, which CI can't reach before a release exists, was run against the
GoReleaser snapshot with a stubbed
gh: tag resolution, checksum verification,zip/tar.gz extraction, and failure on a tampered checksum or missing asset.
Note
PR #3's CI warns that
actions/checkout@v4andactions/setup-go@v5target thedeprecated Node 20. New files here use v7/v7 (Node 24); bumping the existing
workflows is left for a separate change.
🤖 Generated with Claude Code