feat(sarif): make SARIF the live path — mine_report reads it; producers emit it#43
Merged
Conversation
…rs emit it
Finishes the SARIF follow-ups from sarif-export.md: SARIF is now the actual eval
path, not just a capability — retiring the documented parser-drift bug on the
real mine/oracle runs, not only in the comparator's capability.
- mine_report.py: parse() now sniffs a {-leading `runs` log and reads SARIF
structurally, yielding the same finding dicts as the text path (level ->
severity: error->error, warning/note->advisory, so OWN050 and injected-source
warnings stay advisory; kind from properties.resourceKind; trailing [resource:]
split off the message). The regex parser is now off the default path for BOTH
consumers (oracle + miner). New SARIF selftest + human/SARIF aggregation parity
(14/14).
- mine.sh defaults to --format sarif; oracle.yml runs own-check --format sarif.
The intermediate (findings.txt / own.txt) carries a SARIF log; both consumers
sniff the format, so it is backward-compatible (a text intermediate still
parses) and the human view stays the rendered report.md. Filenames kept to keep
the CI edit minimal (content, not extension, is what the consumers read).
- own-check.sh help + docs (sarif-export.md follow-ups -> done; mining.md note).
Deferred (recorded in sarif-export.md): GitHub code-scanning upload (this repo's
C# is test fixtures -> belongs in the P-013 distribution surface, on a real
target); per-rule helpUri.
bash -n + YAML parse clean; mine_report 14/14, oracle 24/24, full suite green,
ruff + mypy --strict clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughSwitches the Own.NET findings pipeline to SARIF as the default format. ChangesSARIF-first Own.NET findings pipeline
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://cdn.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/notes/sarif-export.md`:
- Line 62: Remove the leading space inside the inline code span in the sentence
containing "trailing ` [resource: …]`". The MD038 linting error is triggered
because there is a space immediately after the opening backtick in the code
span. Change the inline code from ` [resource: …]` to `[resource: …]` by
removing the space after the backtick.
In `@scripts/mine_report.py`:
- Around line 102-106: The _parse_sarif function lacks validation for the
structure of runs and results elements, causing it to fail on malformed SARIF
documents instead of handling them gracefully. Add type checking before
processing each run and result object to ensure they are dictionaries before
calling .get() on them or passing them to _sarif_finding(). This way, malformed
entries can be skipped or logged as warnings rather than causing the entire
function to abort.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c55869ef-40c7-442f-aec5-9c183da6cd54
📒 Files selected for processing (6)
.github/workflows/oracle.ymldocs/notes/mining.mddocs/notes/sarif-export.mdscripts/mine.shscripts/mine_report.pyscripts/own-check.sh
Addresses the two CodeRabbit review comments on #43. - mine_report._parse_sarif / _sarif_finding: shape-guard every SARIF node so a malformed runs/results/result or a garbage sub-field degrades to a default instead of crashing the report ({"runs":[1]}, {"runs":[{"results":1}]}, a non-dict result, a non-str message/locations all now skip/default). Same degrade-don't-crash posture as the {-leading-non-SARIF guard. New selftest case pins it (15/15). - docs/notes/sarif-export.md: drop the leading space inside the `[resource: …]` inline code span (markdownlint MD038). ruff + mypy --strict clean; mine_report 15/15, oracle 24/24, full suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED
PhysShell
pushed a commit
that referenced
this pull request
Jun 19, 2026
PhysShell
pushed a commit
that referenced
this pull request
Jun 19, 2026
…(validate the #43 SARIF own-check flip live)
This was referenced Jun 20, 2026
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishes the SARIF follow-ups recorded in
docs/notes/sarif-export.md(after #42 added the emitter + oracle ingestion). SARIF is now the actual eval path, not just a capability — retiring the documented parser-drift bug on the real mine/oracle runs.What changed
mine_report.pyreads SARIF — the second consumer of own-check output (after the oracle).parse()sniffs a{-leadingrunslog and reads it structurally, yielding the same finding dicts as the text path (level → severity:error→error,warning/note→advisory, so OWN050 and injected-source warnings stay advisory; kind fromproperties.resourceKind; the trailing[resource: …]split off the message). The regex parser is now off the default path for both consumers (oracle + miner).mine.shdefaults to--format sarif;oracle.ymlruns own-check--format sarif. The intermediate (findings.txt/own.txt) carries a SARIF log and the human view stays the renderedreport.md. Both consumers sniff the format, so this is backward-compatible (a text intermediate still parses); filenames kept to keep the CI edit minimal (content, not extension, is what's read).sarif-export.mdfollow-ups → done;mining.mdnote;own-check.shhelp.Deferred (recorded in
sarif-export.md)helpUri— once a stable per-code docs anchor exists.Validation
mine_reportselftest 14/14 (new SARIF case + human/SARIF aggregation parity),oracle_compare24/24, full suite green,ruff+mypy --strictclean,bash -n+ YAML-parse clean.oracle.yml/mine-on-push.ymltrigger onclaude/zen-pasteur-76hfs1+ a sentinel file, not on this branch — so this PR's CI does not exercise the flipped workflows. Both Python consumers are tested and the flip is mechanical + backward-compatible; the live validation is the next sentinel-triggered mine/oracle run.🤖 Generated with Claude Code
https://claude.ai/code/session_01Rg8kSk1YT14x7A1vo5zgED
Generated by Claude Code
Summary by CodeRabbit
--format sarif|humanoptions.