feat: add merge-sarif (#37)

Adding a action to merge multiple SARIF files into one. Also contains a test and example files. Reviewed-on: t.behrendt/trivy-actions#37 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
2026-02-15 12:07:03 +01:00
parent 09fb31ca3a
commit 77fa83fb31
5 changed files with 258 additions and 0 deletions
@@ -82,3 +82,31 @@ jobs:

          echo ""
          echo "All checks passed."
+
+  test-merge-sarif-files:
+    name: Test Merge SARIF Files
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Merge SARIF Files
+        uses: ./merge-sarif-files
+        with:
+          files: |
+            - merge-sarif-files/test_sarif1.json
+            - merge-sarif-files/test_sarif2.json
+          output-file: merged.sarif
+      - name: Check merged SARIF file
+        run: |
+          # Structure: version, schema, 2 runs
+          run_count=$(jq '.runs | length' merged.sarif)
+          [ "$run_count" -eq 2 ] || { echo "FAIL: expected 2 runs, got $run_count"; exit 1; }
+          echo "Merged SARIF has $run_count runs."
+          jq -e '.version and .["$schema"] and (.runs | length > 0)' merged.sarif >/dev/null || { echo "FAIL: invalid SARIF structure"; exit 1; }
+
+          # Content: results from test_sarif1.json (ruleId KSV-0014) and test_sarif2.json (ruleId CVE-2026-26019) must be present
+          rule_ids=$(jq -r '[.runs[].results[].ruleId] | unique[]' merged.sarif)
+          echo "$rule_ids" | grep -q 'KSV-0014' || { echo "FAIL: merged file missing result from test_sarif1.json (ruleId KSV-0014)"; exit 1; }
+          echo "$rule_ids" | grep -q 'CVE-2026-26019' || { echo "FAIL: merged file missing result from test_sarif2.json (ruleId CVE-2026-26019)"; exit 1; }
+          echo "Merged results contain ruleIds from both input files."
+          echo "All checks passed."