Create pull request based on data in SARIF file

[varunsh-coder]

The ossf/scorecard project will add recommended fixes for security issues in the SARIF file. In such cases,

1. Is it possible to show a "Copy code snippet" button in the SARIF view in GitHub? So, the developer can copy the fixed file, and paste it in their code.
2. Is it possible to have a "Create Pull Request" button feature that will create a PR based on the fix in the SARIF file?

It is possible to create an OAuth/Github App to create the PR, but the app will need write access to the repo (to create a branch), and we are trying to avoid creating an App with write access to the repo. Would be great if there was direct integration in the GitHub Code Scanning UI to create a PR/ enable copying code based on metadata in the SARIF file.

/cc @laurentsimon

[MathiasVP]

Hi @varunsh-coder,

Thanks for your issue. These are all very good ideas, and I'll bring them to the appropriate engineering team.

[laurentsimon]

/cc @josepalafox