SARIF location uri fields should not be empty

microsoft/sarif-sdk#2770
cloudfoundry · May 16, 2024 · dfeaf43 · dfeaf43
1 parent d45f35c
commit dfeaf43
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
@@ -28,6 +28,13 @@ jobs:
         format: sarif
         output: trivy-results.sarif
 
+    - name: Fix SARIF file uri files
+      run: |
+        jq '.runs | map(.results | map(.locations
+          | map(.physicalLocaion.artifactLocation.uri = "file:///sbom.spdx.json")))' \
+          trivy-results.sarif > tmp.sarif
+        mv tmp.sarif trivy-results.sarif
+
     - uses: actions/upload-artifact@v4
       with:
         name: sbom