Description
openedon Oct 18, 2023
Describe the bug
GitHub Advanced Security requires a 'physicalLocation.artifactLocation.uri' value. GHAS will fail to load the SARIF results if this data is not provided.
The SARIF file from jfrog-cli 2.50.2 scans is missing this value (previous releases have loaded, but I don't have any of them available to confirm).
Each result location must provide the property 'physicalLocation.artifactLocation.uri'. GitHub Advanced Security code scanning will not display a result whose location does not provide the URI of the artifact that contains the result.
Current behavior
SARIF file generated by jfrog-cli 2.50.2 fails the validation using the GHAS ingestion rules ( https://sarifweb.azurewebsites.net/Validation )
Reproduction steps
Generate SARIF file from 2.50.2
Run through the https://sarifweb.azurewebsites.net/Validation page with the GitHub ingestion rules enabled
Expected behavior
Clean results from SARIF Web validation
JFrog CLI version
jf version 2.50.2
Operating system type and version
Centos 8
JFrog Artifactory version
Enterprise Plus 7.55.10 rev 75510900
JFrog Xray version
{"xray_version":"3.65.2","xray_revision":"bca527a"}