Semgrep: Using --sarif doesn't produce output to specification.

[rttwge]

When using the --sarif option a _mostly_ SARIF file is produced but is missing mandatory object runs. Validation fails when using Viewer tools.

Using version v0.13.0 and executed using Python 3.6.10.

Thanks,

Rick

[dlukeomalley]

Thank you for filing a ticket @rttwge. Tagging @underyx and @DrewDennison who have the most context here.

With regards to reproing, is there a specific viewer tool you're using that we can confirm functionality with? Curious about your workflow and how to best support it.

[DrewDennison]

thanks @rttwge. We'll try to get this fixed and also would be happy to accept a PR if you're interested https://github.com/returntocorp/semgrep/blob/develop/semgrep/semgrep/output.py#L159 I'm not 100% sure the difference between runs and results

[rttwge]

Thanks for the fast feedback ... I used SARIF Validator and also tried _Visual Studio Code_ and _Visual Studio 2019_.

I was running from a workflow in github as:
semgrep --config=r2c --strict --sarif ./source > ./CodeAnalysis.sarif

I'm creating an artifact and therefore will upload the .sarif file. I may use the file as is and parse myself or, most likely, use the option --json so there isn't confusion on our end.

The object _runs_ is an array of _run_ objects and the _run_ object, according to specification (3.11.1), is a single run of an analysis tool. Some prior version may have had a run object per language but the current spec shows { "tool": {...}, "results": [ {...}, {...} ...] } for a _run_ object.

Thanks,

Rick

[underyx]

Thanks @rttwge for the link to the validator! The issue you flagged is now fixed with https://github.com/returntocorp/semgrep/pull/1219 — this should most likely be released next Tuesday.

[DrewDennison]

and/or we can give you a way to install this from in a pre-release form if blocking