Skip to content

Error: Unable to upload "./test-results.sarif" as it is not valid SARIF #39

Description

Here is the error i got in github action

Error details: instance requires property "version"
Error details: instance requires property "runs"
  {
    "path": [],
    "property": "instance",
    "message": "requires property \"runs\"",
    "schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
    "instance": {
      "id": "66b357212xxxxxxxxxxd28206a",
      "path": "/user/{username}",
      "impact": "Leak",
      "location": "Response Field.creation",
      "name": "username",
      "label": "DevOps Data",
      "direction": "OUT",
      "severity": "Medium",
      "created_on": "2024-08-09T15:04:44.506Z",
      "response": "{\"id\":9,\"username\":\"johnsmith\",\"firstName\":\"John\",\"lastName\":\"Smith\",\"email\":\"john@example.com\",\"password\":\"p@ssw0rd\",\"phone\":\"phone\",\"userStatus\":1}",
      "explainer": "contact details.",
      "remediation": "partial obfuscation techniques where feasible."
    },
    "name": "required",
    "argument": "runs",
    "stack": "instance requires property \"runs\""
  }
Error: Unable to upload "./test-results.sarif" as it is not valid SARIF:
- instance is not allowed to have the additional property "id"
- instance is not allowed to have the additional property "path"
- instance is not allowed to have the additional property "impact"

Here is my action.yml

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Github Action for API
        uses: DevOps/Github-Action-CI-CD@v28.0
        with:
           hostname: https://cloudnetwork.in/
           username: ${{ secrets.username }}
           password: ${{ secrets.password }}
           sarif-result-file: "devops-results.sarif"

           
      - name: Read file content
        id: read-file
        run: |
          cat devops-results.sarif

      
    ### Upload Sarif File ### 
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: ./devops-results.sarif
          # Optional category for the results
          # Used to differentiate multiple results for one commit
          # category: my-analysis-tool

why im getting sarif upload failed

and also i have SARIF Validator

here is the result

https://sarifweb.azurewebsites.net/Validation
JSON1002: root: The required property 'version' is missing.
JSON1005: id: The schema does not define a property 'id', and the schema does not permit additional properties.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions