Merge pull request #2463 from github/henrymercer/job-uuid-in-sarif

 Add job run UUID to SARIF output

pr-checks/checks/job-run-uuid-sarif.yml

@@ -0,0 +1,30 @@
+name: "Job run UUID added to SARIF"
+description: "Tests that the job run UUID is added to the SARIF output"
+operatingSystems: ["ubuntu"]
+versions: ["nightly-latest"]
+steps:
+  - uses: ./../action/init
+    id: init
+    with:
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/analyze
+    with:
+      output: "${{ runner.temp }}/results"
+  - name: Upload SARIF
+    uses: actions/upload-artifact@v3
+    with:
+      name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
+      path: "${{ runner.temp }}/results/javascript.sarif"
+      retention-days: 7
+  - name: Check results
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/results"
+      actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
+      if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
+        echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
+        exit 1
+      else
+        echo "Found job run UUID '$actual'."
+      fi

src/codeql.ts

@@ -870,6 +870,7 @@ export async function getCodeQLForCmd(
         )}`,
         "--sarif-group-rules-by-pack",
         ...(await getCodeScanningQueryHelpArguments(this)),
+        ...(await getJobRunUuidSarifOptions(this)),
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),
       ];
       if (automationDetailsId !== undefined) {
@@ -1423,3 +1424,14 @@ function applyAutobuildAzurePipelinesTimeoutFix() {
     "-Dmaven.wagon.http.pool=false",
   ].join(" ");
 }
+
+async function getJobRunUuidSarifOptions(codeql: CodeQL) {
+  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+
+  return jobRunUuid &&
+    (await codeql.supportsFeature(
+      ToolsFeature.DatabaseInterpretResultsSupportsSarifRunProperty,
+    ))
+    ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`]
+    : [];
+}

src/tools-features.ts

@@ -3,6 +3,7 @@ import type { VersionInfo } from "./codeql";
 export enum ToolsFeature {
   AnalysisSummaryV2IsDefault = "analysisSummaryV2Default",
   BuildModeOption = "buildModeOption",
+  DatabaseInterpretResultsSupportsSarifRunProperty = "databaseInterpretResultsSupportsSarifRunProperty",
   IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
   InformsAboutUnsupportedPathFilters = "informsAboutUnsupportedPathFilters",
   SetsCodeqlRunnerEnvVar = "setsCodeqlRunnerEnvVar",