name: "Merge SARIF Files"
description: "Merge multiple SARIF files into a single SARIF file"
author: "Timo Behrendt <t.behrendt@t00n.de>"
branding:
  icon: "database"
  color: "blue"

inputs:
  files:
    description: "Paths to SARIF files to merge"
    required: true
  output-file:
    description: "Output file path"
    required: true
    default: "merged.sarif"

runs:
  using: "composite"
  steps:
    - id: merge
      shell: bash
      run: |
        set -e
        files="${{ inputs.files }}"
        output_file="${{ inputs.output-file }}"

        # Parse YAML list: lines like "  - path/to/file" or "- file"
        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")

        # Temp file for merged runs (avoids "Argument list too long" when passing huge JSON via argv)
        runs_temp=$(mktemp)
        trap 'rm -f "$runs_temp"' EXIT

        # Collect all runs from all SARIF files into temp file (streaming, no argv size limit)
        while IFS= read -r file; do
          [ -z "$file" ] && continue
          jq -c '.runs[]?' "$file" 2>/dev/null || true
        done <<< "$file_list" | jq -s '.' > "$runs_temp"

        # Take first file for version/schema, replace .runs with merged array
        first_file=$(echo "$file_list" | head -1)
        if [ -z "$first_file" ]; then
          echo "No input files given."
          exit 1
        fi
        jq -n --slurpfile runs "$runs_temp" --slurpfile first "$first_file" '$first[0] | .runs = $runs[0]' > "$output_file"