chore/security : re-clean

Author: issam71100

.github/actions/fix-trivy-sarif/action.yml

@@ -1,93 +1,40 @@
 name: 'Fix Trivy SARIF File Paths'
-description: 'Dynamically fixes file paths in Trivy SARIF output for proper GitHub Security tab display'
+description: 'Fixes file paths in Trivy SARIF output for GitHub Security tab'
 inputs:
   sarif-file:
     description: 'Path to the SARIF file to fix'
     required: true
   scan-path:
     description: 'The relative path that was scanned (e.g., web/lrm/client)'
     required: true
-  backup:
-    description: 'Create a backup of the original SARIF file'
-    required: false
-    default: 'true'
 
 runs:
   using: 'composite'
   steps:
-    - name: Fix SARIF file paths dynamically
+    - name: Fix SARIF file paths
       shell: bash
       run: |
-        echo "=== Dynamically fixing SARIF file paths ==="
         SARIF_FILE="${{ inputs.sarif-file }}"
         SCAN_PATH="${{ inputs.scan-path }}"
-        CREATE_BACKUP="${{ inputs.backup }}"
         
-        if [ -f "$SARIF_FILE" ]; then
-          echo "Found SARIF file: $SARIF_FILE"
-          echo "Scan path prefix: $SCAN_PATH"
-          
-          # Create backup if requested
-          if [ "$CREATE_BACKUP" = "true" ]; then
-            BACKUP_FILE="${SARIF_FILE%.sarif}-original.sarif"
-            cp "$SARIF_FILE" "$BACKUP_FILE"
-            echo "Backup created: $BACKUP_FILE"
-          fi
-          
-          # Use jq to dynamically fix all file paths in the SARIF
-          jq --arg prefix "${SCAN_PATH}/" '
-            # Fix artifact locations in results
-            (.runs[]?.results[]?.locations[]?.physicalLocation?.artifactLocation?.uri?) |= 
-              if . and (startswith($prefix) | not) and (. != "") then
-                if startswith("file://") then
-                  "file://" + $prefix + (. | sub("^file://"; ""))
-                else
-                  $prefix + .
-                end
-              else
-                .
-              end |
-            
-            # Fix artifact locations in artifacts array
-            (.runs[]?.artifacts[]?.location?.uri?) |= 
-              if . and (startswith($prefix) | not) and (. != "") then
-                if startswith("file://") then
-                  "file://" + $prefix + (. | sub("^file://"; ""))
-                else
-                  $prefix + .
-                end
-              else
-                .
-              end |
-            
-            # Fix any other uri references in the SARIF structure
-            (.runs[]?.tool?.driver?.rules[]?.properties?.uri?) |= 
-              if . and (startswith($prefix) | not) and (. != "") then
-                if startswith("file://") then
-                  "file://" + $prefix + (. | sub("^file://"; ""))
-                else
-                  $prefix + .
-                end
-              else
-                .
-              end
-          ' "$SARIF_FILE" > "${SARIF_FILE}.tmp" && mv "${SARIF_FILE}.tmp" "$SARIF_FILE"
-          
-          echo "✅ SARIF file paths updated dynamically with prefix: ${SCAN_PATH}/"
-          
-          # Show before/after comparison if backup exists
-          if [ "$CREATE_BACKUP" = "true" ] && [ -f "$BACKUP_FILE" ]; then
-            echo ""
-            echo "Before fix (first few file references):"
-            jq -r '.runs[]?.results[]?.locations[]?.physicalLocation?.artifactLocation?.uri?' "$BACKUP_FILE" 2>/dev/null | grep -v "^null$" | head -5 || echo "No file references found in original"
-            echo ""
-            echo "After fix (first few file references):"
-            jq -r '.runs[]?.results[]?.locations[]?.physicalLocation?.artifactLocation?.uri?' "$SARIF_FILE" 2>/dev/null | grep -v "^null$" | head -5 || echo "No file references found in fixed"
-          fi
-          
-          echo ""
-          echo "✅ SARIF file paths have been fixed for GitHub Security tab compatibility"
-        else
-          echo "❌ SARIF file not found: $SARIF_FILE"
+        if [ ! -f "$SARIF_FILE" ]; then
+          echo "::error::SARIF file not found: $SARIF_FILE"
           exit 1
-        fi
+        fi
+        
+        echo "Fixing SARIF file paths with prefix: ${SCAN_PATH}/"
+        
+        # Fix all URI paths in the SARIF file
+        jq --arg prefix "${SCAN_PATH}/" '
+          def fix_uri: 
+            if . and (startswith($prefix) | not) and (. != "") then
+              $prefix + .
+            else
+              .
+            end;
+          
+          (.runs[]?.results[]?.locations[]?.physicalLocation?.artifactLocation?.uri?) |= fix_uri |
+          (.runs[]?.artifacts[]?.location?.uri?) |= fix_uri
+        ' "$SARIF_FILE" > "${SARIF_FILE}.tmp" && mv "${SARIF_FILE}.tmp" "$SARIF_FILE"
+        
+        echo "✅ SARIF file paths fixed successfully"