Adding .sarif extension for validation.

[complexconst]

I have added validation for .sarif extension.

[complexconst]

Could you please approve workflows ??

[complexconst]

Could you please approve workflow once more ? Had missed to push changes in cli.go file

[complexconst]

is there anything from my side for now ?

[kehoecj]

Need to update index.md, readme.md, and the CLI to include Sarif validation

[arthurflame]

Hey folks,

Not entirely sure if this is the most optimal way to validate .sarif files.

I've spent a couple of days implementing the validation myself.
Didn't want to intervene, since this issue was already assigned to @complexconst, but I was curious so I've researched and partially implemented it.

Partially - because I'm neither good, nor decent in Go ):

Here's my take.
Since files with .sarif extension are essentially JSON files, we need a way to somehow distinguish them.
In SARIF v2.1.0 specification we can determine which fields should be present in a .sarif file, so it can be considered valid.
After skimming rather quickly through it, and playing around with .sarif files with a VSCode's SARIF Viewer extension.
I could make this observation:

Minimal .sarif file should include the following fields:

• $schema - preferably should be present, my idea was to spit a warning if this field doesn't exist in the file
• version - key should be present, and a value shouldn't be an empty string
• runs - amount of runs should be at least >= 1
• results - can be an empty slice, but it should be present (in a file, explicitly)
• tool.driver.name - keys should be present, and value shouldn't be an empty string

Let me know what you think.
@complexconst @kehoecj

[arthurflame]

Since sarif.FromBytes does json.Unmarshal, we can return a custom error from JSON validator, which will explicitly display the precise location in the file where error occurred.

[arthurflame]

func (SARIFValidator) Validate(b []byte) (bool, error) {
	_, err := sarif.FromBytes(b)
	if err != nil {
		customError := getCustomErr(b, err)
		return false, customError
	}

Yeah, if return value from sarif.FromBytes (except for the error) isn't needed, it's possible just to use JSON validator instead.

func (SARIFValidator) Validate(b []byte) (bool, error) {
	var output any
	err := json.Unmarshal(b, &output)
	if err != nil {
		customError := getCustomErr(b, err)
		return false, customError
	}
	return true, nil
}

[arthurflame]

I presume it'll be nice to have not only a "good" .sarif file, but also a "bad" one.
Potentially a .sArIf extension would be nice too.

[complexconst]

Ok, I will make required changes.

[complexconst]

Please approve the workflows