claw: sarif_feed -- a spec that does not parse becomes a code-scanning alert on the pull request (Closes #10356)

.github/workflows/gate-topology.yml

@@ -110,3 +110,29 @@ jobs:
                 I=$(head -1 ../bodies | gh api -X POST repos/$r/check-runs --input - -q .id); tail -n +2 ../bodies | while read -r j; do printf '%s' "$j" | gh api -X PATCH repos/$r/check-runs/$I --input - > /dev/null; done ); [ $? = 0 ] || echo "::warning::claw/t27f did not check $r#$n"
             done
           done
+
+  # claw/sarif: a changed .t27 spec that does not parse, or declares functions with no body, becomes a code-scanning
+  # alert from the TRI CLAW App. The law is specs/claw/sarif_feed.t27 (gen/c/claw/sarif_feed.c); this job mints the
+  # token (security_events write + contents read, the code-scanning-sarif row of specs/claw/github_surface.t27),
+  # runs the signed t27o release t27c over the changed specs and uploads what the law prints.
+  claw-sarif:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    permissions: {contents: read}
+    steps:
+      - id: have
+        env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}"}
+        run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/sarif uploaded nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
+      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-security-events: write, permission-contents: read}}
+      - {if: steps.have.outputs.ok, uses: actions/checkout@v6, with: {fetch-depth: 2}}
+      - {if: steps.have.outputs.ok, uses: sigstore/cosign-installer@v3}
+      - if: steps.have.outputs.ok
+        env: {V: t27o-v0.1.0}
+        run: |
+          cd /tmp; B=https://github.com/gHashTag/t27/releases/download/$V
+          for f in t27c checksums-$V.txt; do curl -fsSLo $f $B/$f; curl -fsSLo $f.sigstore.json $B/$f.sigstore.json
+            cosign verify-blob $f --bundle $f.sigstore.json --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp "^https://github.com/gHashTag/t27/.github/workflows/t27o-release.yml@refs/tags/$V$"; done
+          sha256sum -c --ignore-missing checksums-$V.txt; chmod +x t27c; cd "$GITHUB_WORKSPACE"
+          printf '#include "gen/c/claw/sarif_feed.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(void){size_t k=1<<22,n;uint8_t*b=malloc(k),*o=malloc(k);n=fread(b,1,k,stdin);size_t m=feed_sarif(b,n,o,k);if(n==k||m>k)return 3;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -I . -x c -o /tmp/feed -
+          git diff --name-only --diff-filter=d HEAD^1 HEAD -- '*.t27' | while read -r f; do printf '%s\t%s\t%s\n' "$f" "$(/tmp/t27c spec-status "$f" 2>&1 </dev/null | tail -1)" "$(/tmp/t27c parse "$f" 2>&1 >/dev/null </dev/null | head -1)"; done | /tmp/feed > /tmp/claw.sarif
+      - {if: steps.have.outputs.ok, uses: github/codeql-action/upload-sarif@v4, with: {sarif_file: /tmp/claw.sarif, category: claw/sarif, token: "${{ steps.tok.outputs.token }}"}}

.github/workflows/spec-guards.yml

@@ -126,8 +126,9 @@ jobs:
         run: |
           ./target/release/t27c gen-c specs/claw/gates.t27 > gen/c/claw/gates.c
           ./target/release/t27c gen-c specs/claw/t27f_gate.t27 > gen/c/claw/t27f_gate.c
+          ./target/release/t27c gen-c specs/claw/sarif_feed.t27 > gen/c/claw/sarif_feed.c
           ./target/release/t27c gen-json specs/igla/own_model_board.t27 > gen/json/igla/own_model_board.json
-          git diff --exit-code -- gen/c/claw/gates.c gen/c/claw/t27f_gate.c gen/json/igla/own_model_board.json
+          git diff --exit-code -- gen/c/claw/gates.c gen/c/claw/t27f_gate.c gen/c/claw/sarif_feed.c gen/json/igla/own_model_board.json
 
       # #7565: test only the specs this change can affect. specs/ci/affected.t27 picks them (the
       # changed specs and every spec that imports one through `use`, transitively); the graph is the

AGENTS.md

@@ -142,6 +142,7 @@ reusable workflow. Epic #9271.
 | Docs, release checklist, competitors | [`docs/claw/`](docs/claw/README.md) |
 | The GitHub App | [github.com/apps/tri-claw](https://github.com/apps/tri-claw), id 5166765, installed on all repositories. It is the reviewer-bee identity ([`tools/bees/README.md`](tools/bees/README.md)): bees approve under its name, so a review is never the author approving itself. It also posts the `claw/t27f` check below |
 | T27F check `claw/t27f` (#10268): changed specs and their direct importers, judged by their seals | law [`specs/claw/t27f_gate.t27`](specs/claw/t27f_gate.t27), lowered to `gen/c/claw/t27f_gate.c`; run every 10 minutes by the `claw-t27f` job of `.github/workflows/gate-topology.yml` |
+| SARIF alerts `claw/sarif` (#10356): a changed spec that does not parse or is unwritten, as a code-scanning alert | adapter [`specs/claw/sarif_feed.t27`](specs/claw/sarif_feed.t27) over [`specs/claw/sarif.t27`](specs/claw/sarif.t27), lowered to `gen/c/claw/sarif_feed.c`; run on every pull request by the `claw-sarif` job of `.github/workflows/gate-topology.yml` |
 
 The `claw/t27f` check: one scheduled job in this repository posts it on every
 open pull request that touches `.t27`, in each repository the App is installed

docs/claw/README.md

@@ -13,6 +13,7 @@ behind one front door, with the gate logic in `.t27` specs. Epic
 | Drift audit in CI | `gate-topology` workflow, "claw drift" step | T3, this branch |
 | GitHub App manifest | release step, see `docs/claw/RELEASE.md` | T4, deferred to App setup |
 | T27F check in every `.t27` repository | `specs/claw/t27f_gate.t27`, the `claw-t27f` job of `gate-topology.yml` | #10268, live once the owner steps below are done |
+| SARIF code-scanning alerts on a pull request | `specs/claw/sarif_feed.t27` over `specs/claw/sarif.t27`, the `claw-sarif` job of `gate-topology.yml` | #10356, live once the owner steps below are done |
 | Service skeleton | Railway, thin I/O glue only | T5, merged (spec contract) |
 | Positioning / pricing | `docs/claw/competitors.md` | T6, started |
 
@@ -31,6 +32,18 @@ steps, it posts nothing:
 3. Set the secret `CLAW_APP_PRIVATE_KEY` in gHashTag/t27 to the App's private key.
 4. Set the variable `CLAW_APP_ID` in gHashTag/t27 to `5166765`.
 
+## SARIF code-scanning alerts on a pull request (#10356)
+
+On every pull request in gHashTag/t27 the `claw-sarif` job of `gate-topology.yml` runs the signed t27o-v0.1.0
+t27c (`spec-status` and `parse`) over each changed `.t27` file and uploads one SARIF run
+(category `claw/sarif`) with the token of the `code-scanning-sarif` row of `specs/claw/github_surface.t27`:
+`security_events` write and `contents` read, nothing else. A spec that does not parse is rule T27C001 (error,
+at the line:col t27c names); a spec with unwritten functions is T27C004 (warning). The adapter is
+`specs/claw/sarif_feed.t27` (lowered to `gen/c/claw/sarif_feed.c`); the document is `specs/claw/sarif.t27`.
+Rules T27C002 and T27C003 need the t27c test runner, which needs zig, and are not fed yet. It needs the secret and
+variable of steps 3 and 4 above, the App permission `security_events: write`, and code scanning enabled on the
+repository; without them the job uploads nothing and says so in its step summary.
+
 ## The inventory spec and how to regenerate it
 
 `specs/claw/gates.t27` holds three parallel `[67]str`-shaped arrays — `NAMES`