ionide / FSharp.Analyzers.SDK

Library for building custom analyzers for F# / FSAC
http://ionide.io/FSharp.Analyzers.SDK/
MIT License
74 stars 22 forks source link

Sarif file should not report absolute file paths #154

Closed nojaf closed 11 months ago

nojaf commented 11 months ago

There is something wrong with the generated file path in the results:

        {
          "ruleId": "IONIDE-004",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Field inside union case is not named!"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///C:/Users/nojaf/Projects/fantomas/src/Fantomas.Client/LSPFantomasService.fs"
                },
                "region": {
                  "startLine": 29,
                  "startColumn": 19,
                  "endLine": 29,
                  "endColumn": 25
                }
              }
            }
          ]
        },

leads to

[GH1006](http://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html): GitHub Advanced Security code scanning will reject a SARIF file that expresses result locations as absolute 'file' scheme URIs unless GitHub can determine the URI of the repository root (which GitHub refers to as the "checkout path"). There are three ways to address this issue. 1. Recommended: Express all result locations as relative URI references with respect to the checkout path. 1. Place the checkout path in 'invocations[].workingDirectory'. The SARIF specification defines that property to be the working directory of the process that executed the analysis tool, so if the tool was not invoked from the repository root directory, it isn't strictly legal to place the checkout path there. 2. Place the checkout path in a configuration file at the root of the repository. This requires the analysis tool always to be invoked from that same directory.
nojaf commented 11 months ago

Use a relative path in physicalLocation.artifactLocation.uri and add workingDirectory to invocations.

          "workingDirectory": {
            "uri": "file:///C:/Users/nojaf/Projects/fantomas"
          }