From a3e6f4be158f8966d02d3884ad836dc48bb02e75 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 9 Aug 2024 10:46:42 +0200
Subject: [PATCH] hack: ensure SARIF output has results field defined for
 govulncheck

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 hack/dockerfiles/govulncheck.Dockerfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile
index 2d334c7a..df2cc876 100644
--- a/hack/dockerfiles/govulncheck.Dockerfile
+++ b/hack/dockerfiles/govulncheck.Dockerfile
@@ -6,6 +6,7 @@ ARG FORMAT="text"
 
 FROM golang:${GO_VERSION}-alpine AS base
 WORKDIR /go/src/github.com/docker/buildx
+RUN apk add --no-cache jq moreutils
 ARG GOVULNCHECK_VERSION
 RUN --mount=type=cache,target=/root/.cache \
     --mount=type=cache,target=/go/pkg/mod \
@@ -17,6 +18,12 @@ RUN --mount=type=bind,target=. <<EOT
   set -ex
   mkdir /out
   govulncheck -format ${FORMAT} ./... | tee /out/govulncheck.out
+  if [ "${FORMAT}" = "sarif" ]; then
+    # Make sure "results" field is defined in SARIF output otherwise GitHub Code Scanning
+    # will fail when uploading report with "Invalid SARIF. Missing 'results' array in run."
+    # Relates to https://github.com/golang/vuln/blob/ffdef74cc44d7eb71931d8d414c478b966812488/internal/sarif/sarif.go#L69
+    jq '(.runs[] | select(.results == null) | .results) |= []' /out/govulncheck.out | tee >(sponge /out/govulncheck.out)
+  fi
 EOT
 
 FROM scratch AS output