normalize-sarif-paths.sh leaves fixes[] URIs un-rooted, so its fail-closed guarantee does not cover them #2863

🤖 Generated by the Agentic Engineer

Follow-up defect in the implementation merged by #2830 (closing #2829). Found by independently deriving the same normalisation and diffing it against the merged version.

Evidence — measured on origin/main (ksail 7.178.1, exceptions applied)

scripts/normalize-sarif-paths.sh re-roots .runs[].results[].locations[].physicalLocation.artifactLocation.uri. Kubescape also emits the same un-rooted path a second time, under .runs[].results[].fixes[].artifactChanges[].artifactLocation.uri, and the script never touches that field.

Running the merged script against a real scan of this repo:

normalize-sarif-paths: 0 already root-relative, 4 prefixed with k8s/, 0 empty-uri group(s) dropped.

locations: k8s/bases/infrastructure/vault-config/job.yaml   <- rewritten
fixes:        bases/infrastructure/vault-config/job.yaml    <- untouched

All four surviving fixes[] URIs resolve to nothing at the repository root:

DEAD bases/apps/umami/cron-job.yaml
DEAD bases/infrastructure/vault-backup/cron-job.yaml
DEAD bases/infrastructure/vault-backup/job.yaml
DEAD bases/infrastructure/vault-config/job.yaml

Why it matters

This is precisely the condition the script was written to make impossible. Its own header says an unresolvable uri is "a hard error naming the uri, because silently uploading it recreates exactly the dead-alert bug this prevents" — but both the resolve loop and the closing fail-closed re-check read locations[] only, so that guarantee silently does not extend to fixes[]. The file the script certifies as clean still contains four paths that point nowhere.

Scope, stated honestly: GitHub does not currently render autofix from third-party SARIF, so this is latent rather than user-visible today — it is not causing broken suggestions right now. What is real now is that the scripts fail-closed contract is narrower than it reads, and the SARIF we publish is internally inconsistent: the same finding carries one live path and one dead one. Anything that consumes fixes[] — a future Code Scanning capability, or any other SARIF consumer — gets a path that does not exist, and the guard designed to catch that will stay green.

Contributing cause

scripts/normalize-sarif-paths.sh has no test. ci.yaml runs shellcheck over it and nothing else, while its sibling scripts/summarize-sarif-findings.sh does have scripts/tests/test-summarize-sarif-findings.sh wired into CI. Shellcheck cannot see a missing jq path, so no gate covers the scripts actual behaviour.

Acceptance criteria

• fixes[].artifactChanges[].artifactLocation.uri is re-rooted by the same resolve-based rule as locations[] (leave-alone / prefix / hard-error), preserving idempotency.
• The closing fail-closed re-check covers fixes[] URIs, so a future gap in either field fails the job rather than uploading dead paths.
• A scripts/tests/test-normalize-sarif-paths.sh exists, is wired into ci.yaml and its paths filter, and fails against the current script (RED) and passes after the fix (GREEN).
• Empty-uri and already-root-relative behaviour is unchanged, with a control proving the new assertion is load-bearing.

Size

S — one jq path, one re-check loop, one new test file.