Invalid SARIF file created when there are no results

pdil commented 1 year ago

Issue

sarif_output creates an invalid file when there are no lintr results (i.e. all linting checks passed). This causes workflows that upload the file to GitHub to populate the Code scanning section of the Security tab to fail.

Example

See this GitHub Actions run file for an example of the error (under Upload analysis results to GitHub):

Run github/codeql-action/upload-sarif@v2
  with:
    sarif_file: lintr-results.sarif
    wait-for-processing: true
    checkout_path: /home/runner/work/usmap/usmap
    token: ***
    matrix: null
  env:
    R_LIBS_USER: /home/runner/work/_temp/Library
    TZ: UTC
    _R_CHECK_SYSTEM_CLOCK_: FALSE
    NOT_CRAN: true
Uploading results
  Processing sarif files: ["lintr-results.sarif"]
  Error: Invalid SARIF. Missing 'results' array in run.
  Error: Error: Invalid SARIF. Missing 'results' array in run.
      at countResultsInSarif (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-lib.js:166:19)
      at uploadFiles (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-lib.js:256:30)
      at async Object.uploadFromActions (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-lib.js:132:12)
      at async run (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-sarif-action.js:46:30)
      at async runWrapper (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-sarif-action.js:68:9)

The SARIF file for my project comes back as follows:

sarif_output(lint_package())

{
  "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "lintr",
          "informationUri": "https://lintr.r-lib.org/",
          "version": "3.0.2"
        }
      },
      "columnKind": "utf16CodeUnits",
      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "<file path>"
        }
      }
    }
  ]
}

Notice there is no results array inside runs.

Proposed solution

Include the results array inside each run in the SARIF file even if there are no issues returned by lintr. I believe it should work if it's an empty array in that case (i.e. "results": []).

Further reference

MichaelChirico commented 1 year ago

Thanks for the report! Unfortunately I think none of the maintainers are particularly adept with SARIF, so a PR would be welcome! cc original PR author @shaopeng-gh

Happy to help any PR authors who get stuck.

pdil commented 1 year ago

Thanks @MichaelChirico, just opened a PR.

shaopeng-gh commented 1 year ago

@pdil Thanks for reporting and fixing the issue! Both you description of the issue and the fix looks good to me.

r-lib / lintr