coding guidelines in sarif

Signed-off-by: Anas Nashif <[email protected]>

Author: nashif

.github/workflows/coding_guidelines.yml

@@ -50,15 +50,17 @@ jobs:
         # debug
         ls -la
         git log  --pretty=oneline | head -n 10
-        ./scripts/ci/guideline_check.py --output output.txt -c origin/${BASE_REF}..
+        pip3 install simple-sarif
+        ./scripts/ci/guideline_check.py --sarif results.sarif -c origin/${BASE_REF}..
 
-    - name: check-warns
-      run: |
-        if [[ -s "output.txt" ]]; then
-            errors=$(cat output.txt)
-            errors="${errors//'%'/'%25'}"
-            errors="${errors//$'\n'/'%0A'}"
-            errors="${errors//$'\r'/'%0D'}"
-            echo "::error file=output.txt::$errors"
-            exit 1;
-        fi
+    - name: Post SARIF findings in the pull request
+      if: github.event_name == 'pull_request'
+      uses: sett-and-hive/[email protected]
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        repository: ${{ github.repository }}
+        branch: ${{ github.head_ref }}
+        pr-number: ${{ github.event.number }}
+        sarif-file: results.sarif
+        title: My security issue
+        dry-run: false

scripts/ci/guideline_check.py

@@ -7,6 +7,7 @@
 import argparse
 import re
 from unidiff import PatchSet
+import simple_sarif
 
 if "ZEPHYR_BASE" not in os.environ:
     exit("$ZEPHYR_BASE environment variable undefined.")
@@ -45,11 +46,31 @@ def parse_args():
                         help="Commit range in the form: a..b")
     parser.add_argument("-o", "--output", required=False,
                         help="Print violation into a file")
+    parser.add_argument("-s", "--sarif", required=False,
+                        help="Genrate sarif file")
     return parser.parse_args()
 
 
 def main():
     args = parse_args()
+
+    if args.sarif:
+        var = simple_sarif.Sarif(file=f"{args.sarif}", validate=True, recreate=True)
+        var.add_rule(
+            "MISRA 21.2",
+            "zephyr.rule_21.1",
+            "Should not used a reserved identifier",
+            "Should not used a reserved identifier.",
+            {
+                "note": {
+                    "text": "Rule passed."
+                },
+                "error": {
+                    "text": "Rule failed."
+                }
+            }
+        )
+
     if not args.commits:
         exit("missing commit range")
 
@@ -104,10 +125,32 @@ def main():
         for hunk in f:
             for line in hunk:
                 if line.is_added:
-                    violation = "{}:{}".format(f.path, line.target_line_no)
+                    violation = f"{f.path}:{line.target_line_no}"
                     if violation in violations:
                         numViolations += 1
-                        if args.output:
+
+                        if args.sarif:
+                            print(
+                                "{}:{}".format(
+                                    violation, "\t\n".join(
+                                        violations[violation])))
+                            var.add_result(
+                                ruleId="zephyr.rule_21.1",
+                                message_id="Should not used a reserved identifier",
+                                arguments=[],
+                                locations=[{
+                                    "physicalLocation": {
+                                        "artifactLocation": {
+                                            "uri": f.path
+                                        },
+                                        "region": {
+                                            "startLine": line.target_line_no
+                                        }
+                                    }
+                                }],
+                                level="error"
+                            )
+                        elif args.output:
                             with open(args.output, "a+") as fp:
                                 fp.write("{}:{}\n".format(
                                     violation, "\t\n".join(
@@ -118,6 +161,9 @@ def main():
                                     violation, "\t\n".join(
                                         violations[violation])))
 
+    if args.sarif:
+        var.save()
+        print("sarif file generated")
     return numViolations