fix action

merge-sarif-files/action.yaml

@@ -24,14 +24,19 @@ runs:
         files="${{ inputs.files }}"
         output-file="${{ inputs.output-file }}"
 
-        # Sarif files are easy to merge. They contain a "runs" array. We just need to concat the runs arrays and write the result to the output file.
-        # Collect all the runs from all 
-        runs=()
-        for file in $files; do
-          runs+=($(jq -r '.runs' $file))
-        done
+        # Parse YAML list: lines like "  - path/to/file" or "- file"
+        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
 
-        # Write the merged runs to the output file.
-        echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json","runs":[' > $output-file
-        echo "${runs[@]}" | jq -s '.' >> $output-file
-        echo ']}' >> $output-file
+        # Collect all runs from all SARIF files (each run as one compact JSON line)
+        runs_json=$(while IFS= read -r file; do
+          [ -z "$file" ] && continue
+          jq -c '.runs[]?' "$file" 2>/dev/null || true
+        done <<< "$file_list" | jq -s '.')
+
+        # Take first file for version/schema, replace .runs with merged array
+        first_file=$(echo "$file_list" | head -1)
+        if [ -z "$first_file" ]; then
+          echo "No input files given."
+          exit 1
+        fi
+        jq -n --argjson runs "$runs_json" --slurpfile first "$first_file" '$first[0] | .runs = $runs' > "$output-file"