Invalid SARIF format reported by CodeQL upload-sarif

[komish]

Summary

I have the same issue outlined here #1220 . I've been searching through all the referenced issues and must be missing the conclusion at which I should arrive. My apologies if it's something obvious.

This was closed with references to issues that don't seem to actually describe a fix other than "it's working". Rolling back to a previous version of gosec seems to be the only path that works for me, as I've tested the latest version of the action, as well as manually installing gosec binaries at both the latest release and the master branch with no change. They all produce the issue.

I do not use the securego/gosec action, I just tried it to see if it's working (didn't seem to work for me).

In my GitHub actions, I install the gosec tool directly from this repository. I've also replicated this locally (as in, I've installed various versions of gosec and generated my SARIF, then I ran the codeql/upload-sarif Validation logic locally).

I's unclear whether the schema def that's been added to gosec needs to be used by the codeql repositories and we need to chase this down there, or if there's an issue with the file that's used here.

Any guidance is much appreciated.

Steps to reproduce the behavior

gosec version

master @ 3004932
2.21.2

Go version (output of 'go version')

1.22.6

Operating system / Environment

N/A

Expected behavior

I expect the generated SARIF to be considered valid by the codeql/upload-sarif logic

Actual behavior

It's not considered valid.

[ccojocar]

Did you use the master version of GitHub action? It works fine with gosec build. See the details #1220 (comment)

https://github.com/securego/gosec/actions/runs/10880221244/job/30186534443

[komish]

I’ll test again to be sure, but as mentioned, I don’t use the GitHub action for gosec in my pipelines.

[ccojocar]

This should be fixed now in v2.21.3 release. It is tested with the master version of the action in #1228.

[komish]

Confirmed, working for me. Thanks for your help here @ccojocar.