.gitea/workflows/ci.yaml

@@ -98,9 +98,8 @@ jobs:
           output-file: merged.sarif
       - name: Check merged SARIF file
         run: |
-          runs=$(jq -r '.runs' merged.sarif)
-          echo "Runs:"
-          echo "$runs"
-          # check that there are two runs in the array
-          [ "$(echo "$runs" | jq 'length')" -eq 2 ] && echo "OK" || { echo "FAIL (got $(echo "$runs" | jq 'length'), expected 2)"; exit 1; }
+          run_count=$(jq '.runs | length' merged.sarif)
+          [ "$run_count" -eq 2 ] || { echo "FAIL: expected 2 runs, got $run_count"; exit 1; }
+          echo "Merged SARIF has $run_count runs."
+          jq -e '.version and .["$schema"] and (.runs | length > 0)' merged.sarif >/dev/null || { echo "FAIL: invalid SARIF structure"; exit 1; }
           echo "All checks passed."

merge-sarif-files/action.yaml

@@ -22,7 +22,7 @@ runs:
       run: |
         set -e
         files="${{ inputs.files }}"
-        output-file="${{ inputs.output-file }}"
+        output_file="${{ inputs.output-file }}"
 
         # Parse YAML list: lines like "  - path/to/file" or "- file"
         file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
@@ -39,4 +39,4 @@ runs:
           echo "No input files given."
           exit 1
         fi
-        jq -n --argjson runs "$runs_json" --slurpfile first "$first_file" '$first[0] | .runs = $runs' > "$output-file"
+        jq -n --argjson runs "$runs_json" --slurpfile first "$first_file" '$first[0] | .runs = $runs' > "$output_file"