Skip to content

spec(claw): sarif.t27 -- t27c findings as SARIF 2.1.0 for code scanning - #10288

Merged
gHashTag merged 4 commits into
masterfrom
claude/claw-sarif
Oct 18, 2026
Merged

spec(claw): sarif.t27 -- t27c findings as SARIF 2.1.0 for code scanning#10288
gHashTag merged 4 commits into
masterfrom
claude/claw-sarif

Conversation

@gHashTag

@gHashTag gHashTag commented Oct 18, 2026

Copy link
Copy Markdown
Owner

Closes #10284

Row code-scanning-sarif of specs/claw/github_surface.t27 (#10280, epic #9271).

What

specs/claw/sarif.t27 shapes t27c findings into a SARIF 2.1.0 document that GitHub code scanning accepts: findings then show in the Security tab and inline on the PR diff, and close on their own when fixed.

  • Input: one finding per line, six TAB-separated fields (severity slug path line col message).
  • Four stable rule ids (T27C001 to T27C004), severity mapping error/warning/info(note) to the SARIF levels.
  • Plain repo-relative paths only; regions clamp to 1; JSON escaping; message cut at 500 bytes; result cap.
  • Fail closed: unknown severity, rule, path or number drops the line and sets invocations[0].executionSuccessful to false. A clipped buffer is detectable (sarif_fits). Empty input gives a valid empty run, which closes every open alert.
  • specs/claw/sarif_pins.t27 is the test-only companion that pins the explicit length tables with .len (the gates_pins.t27 split), because gen-c cannot express .len.

Lab evidence (Railway)

  • t27c spec-status specs/claw/sarif.t27: IMPLEMENTED
  • t27c test-report on sarif.t27: 15 pass, 0 FAIL, 0 vacuous
  • t27c test-report on sarif_pins.t27: 5 pass, 0 FAIL, 0 vacuous
  • t27c gen-c specs/claw/sarif.t27 lowers (rc 0); the C parses. gen-c emits one -Wincompatible-pointer-types warning for the array parameter of parse_line; a harness needs to account for it.

Not in this PR

The upload step (github/codeql-action/upload-sarif with the job's own GITHUB_TOKEN and security-events: write) is workflow YAML, foreign code, and needs a shrink offset. An adapter from t27c output to the TSV input is also still to do (parse errors carry no file path; test-report and spec-status words need mapping). Both are the next step.

Only .t27 files are added; no workflow, gate file, seal or generated file is touched.

🤖 Generated with Claude Code

gHashTag and others added 4 commits October 18, 2026 14:30
@gHashTag @claude
spec(claw): sarif.t27 -- t27c findings as SARIF 2.1.0 for code scanni…
6141ca2 
…ng (Closes #10284)

Row code-scanning-sarif of specs/claw/github_surface.t27. The spec holds the
rule table, the severity mapping, the path and region rules, JSON escaping,
the result cap and the document itself; a companion test-only spec pins the
length tables. Unknown severity, rule, path or number drops the line and
sets executionSuccessful to false; a clipped buffer is detectable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag @claude
spec(claw): sarif.t27 -- read carriage return as byte 13 (Closes #10284)
3443418 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag @claude
spec(claw): sarif_pins.t27 -- compare strings bytewise (Closes #10284)
e177352 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag @claude
spec(claw): sarif_pins.t27 -- url pins run at runtime, not folded (Cl…
c6984a8 
…oses #10284)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@gHashTag
gHashTag enabled auto-merge (squash) October 18, 2026 07:35
@github-actions github-actions Bot mentioned this pull request Oct 18, 2026
Merged
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 07:39:10 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 46
PRs with All Checks Green 4
READY 0
FAILING 46
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 46 + 0 + 0 = 46, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=0f8c66b9ed0e != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Oct 18, 2026
Merged
Merged
Merged
@gHashTag
gHashTag merged commit db5dddf into master Oct 18, 2026
28 of 30 checks passed
This was referenced Oct 18, 2026
Closed
Merged
gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
dupe-ledger: bless the claw helper copies from #10283/#10286/#10287/#…
4414941 
…10288 (Closes #10311) (#10312)

duplicate-bodies has been red on master since the claw specs landed
without moving the ledger. Each new group and why it stays for now:

- buf_has, digit_byte, put_count, put_str (gates.t27 + sarif.t27,
  #10288): deliberate. sarif.t27 says so in its header: the writers are
  private in gates.t27 and sarif.t27 must lower alone under gen-c.
- bytes_eq 2 -> 3 (`same` in sarif_pins.t27, #10288): the test-only
  pins companion compares strings by .len, which gen-c cannot lower.
- str_eq (gates.t27 + suggest.t27, #10286) and has_prefix
  (service.t27 #10283, starts_with in preview.t27 #10287): same
  lower-alone constraint; sharing them into one claw helper module is
  a follow-up, not this commit.

The ledger is `python3 tools/dupe_scan.py --bless` output on master
238b6a9, run on the Railway lab; the gate exits 0 after it. Not
hand-edited.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag gHashTag mentioned this pull request Oct 18, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

spec(claw): sarif.t27 -- t27c findings as SARIF 2.1.0 for code scanning (row code-scanning-sarif)

1 participant

@gHashTag