feat(ci): add SARIF output to npm audit workflow by Copilot · Pull Request #433 · github/gh-aw-firewall

Copilot · 2026-01-27T03:31:09Z

npm audit results currently only appear in workflow logs. This adds SARIF upload to surface vulnerabilities in the GitHub Security tab alongside CodeQL and Trivy scans.

Changes

scripts/ci/npm-audit-to-sarif.ts: TypeScript converter for npm audit JSON → SARIF 2.1.0
- Maps npm severity to SARIF levels (critical/high → error, moderate → warning, low/info → note)
- Extracts advisory metadata (title, URL, version range, fix availability)
- Generates unique rule IDs from advisory sources
.github/workflows/dependency-audit.yml: Updated workflow to generate and upload SARIF
- Added security-events: write permission
- Split audit into: JSON generation → SARIF conversion → upload → failure check
- Separate categories: npm-audit-main and npm-audit-docs
- SARIF upload runs with if: always() to capture results even when vulnerabilities exist
- Preserves existing behavior: workflow still fails on high/critical vulnerabilities

Workflow

- name: Run npm audit (JSON output for SARIF)
  run: npm audit --json > npm-audit-main.json || true
  continue-on-error: true

- name: Convert npm audit to SARIF
  if: always()
  run: npx tsx scripts/ci/npm-audit-to-sarif.ts npm-audit-main.json npm-audit-main.sarif

- name: Upload npm audit SARIF to GitHub Security tab
  if: always()
  uses: github/codeql-action/upload-sarif@f68537f3d8a6955880f700730943f8a754454193 # v4
  with:
    sarif_file: npm-audit-main.sarif
    category: npm-audit-main

- name: Run npm audit (fail on high/critical)
  run: npm audit --audit-level=high

Vulnerabilities will now appear in Security → Code scanning alerts with proper severity classification and advisory links.

Original prompt

This section details on the original issue you should resolve

<issue_title>[plan] add sarif output to npm audit workflow</issue_title>
<issue_description>## Objective

Enhance the dependency-audit.yml workflow to upload npm audit results as SARIF to the GitHub Security tab, improving visibility of dependency vulnerabilities.

Context

Currently, npm audit results only appear in workflow logs, making it difficult to:

Track vulnerabilities across PRs

Triage security issues in one place

Get alerts for new vulnerabilities

CodeQL and Trivy already upload SARIF successfully.

Approach

Update .github/workflows/dependency-audit.yml

Add step to convert npm audit JSON output to SARIF format

Use github/codeql-action/upload-sarif@v3 to upload results

Consider using a tool like:

npm-audit-resolver with SARIF export

Custom script to convert npm audit JSON to SARIF

Switch to jeremylong/DependencyCheck which has built-in SARIF support

Files to Modify

Update: .github/workflows/dependency-audit.yml

Potentially create: scripts/npm-audit-to-sarif.js (if custom conversion needed)

Acceptance Criteria

npm audit results appear in Security tab (Code scanning alerts)

SARIF upload succeeds in workflow

Vulnerabilities are properly categorized by severity

Workflow continues to fail on high/critical vulnerabilities

References

SARIF format: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html

GitHub SARIF upload: https://github.com/github/codeql-action/tree/main/upload-sarif

Example: .github/workflows/codeql.yml (existing SARIF upload)
Related to [plan] improve ci/cd pipeline and quality gates #348

AI generated by Plan Command for discussion #345

Comments on the Issue (you are @copilot in this section)

Fixes [plan] add sarif output to npm audit workflow #351

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Mossaka · 2026-01-30T20:49:24Z

@copilot-swe-agent review

Copilot · 2026-01-30T20:53:39Z

@copilot-swe-agent review

Code review complete ✅

The implementation is production-ready and working correctly:

✅ Verified:

SARIF 2.1.0 format generation with proper severity mapping
Correct handling of both main and docs-site packages
Only reports root cause advisories (not transitive dependencies)
Workflow permissions and error handling configured properly
Tested with real npm audit data - generates valid SARIF files

Testing results:

Main package: 1 advisory reported (eslint vulnerability)
Docs site: 2 advisories reported
Artifact URIs correctly reference package.json and docs-site/package.json
CodeQL: No security issues detected

Note: The script correctly reports only root cause security advisories, not every transitive dependency affected. For example, if eslint has a vulnerability and 4 other packages depend on it, SARIF reports 1 issue (eslint), not 5.

All acceptance criteria met - ready to merge.

github-advanced-security · 2026-01-30T20:56:18Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Mossaka · 2026-02-03T19:32:05Z

@copilot please merge origin/main

…copilot/add-sarif-output-to-npm-audit

Mossaka

Review: REQUEST_CHANGES

@copilot Please fix the following issue:

Issue: Missing Null Safety Check

In scripts/ci/npm-audit-to-sarif.ts, if npm audit --json produces malformed output (empty object or missing vulnerabilities key), the script will crash with:

TypeError: Cannot convert undefined or null to object

Required Fix

Add defensive null check:

// Before (current code):
for (const [pkgName, vuln] of Object.entries(npmAudit.vulnerabilities)) {

// After (with null safety):
const vulnerabilities = npmAudit.vulnerabilities || {};
for (const [pkgName, vuln] of Object.entries(vulnerabilities)) {

Minor Suggestion

The workflow uses both || true AND continue-on-error: true on the JSON generation step. Only one is needed - consider removing the redundant continue-on-error: true.

The SARIF implementation is otherwise correct and follows best practices.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

github-actions · 2026-02-04T17:37:19Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-04T17:37:21Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-04T17:37:54Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.44%	82.44%	➡️ +0.00%
Statements	82.47%	82.47%	➡️ +0.00%
Functions	81.77%	81.77%	➡️ +0.00%
Branches	75.59%	75.59%	➡️ +0.00%

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-02-04T17:40:40Z

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

feat: filter benign operational logs from Squid access.log #432: feat: filter benign operational logs from Squid access.log
feat: allow empty allowDomains to block all network access #451: feat: allow empty allowDomains to block all network access

Test Results:

✅ GitHub MCP: Successfully retrieved merged PRs
❌ Playwright: Browser binaries not available in environment
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-21681137817.txt
✅ Bash Tool: Verified file content

Status: PARTIAL PASS (3/4 tests passed)

Note: Playwright test failed due to missing browser binaries, not a Claude engine issue.

AI generated by Smoke Claude

github-actions · 2026-02-04T17:41:01Z

Smoke Test Results (Copilot) ✅ PASS

Last 2 Merged PRs:

feat: filter benign operational logs from Squid access.log #432: feat: filter benign operational logs from Squid access.log
feat: allow empty allowDomains to block all network access #451: feat: allow empty allowDomains to block all network access

Tests:

✅ GitHub MCP: Retrieved PR data
✅ Playwright: GitHub page title verified
✅ File Write: Created /tmp/gh-aw/agent/smoke-test-copilot-21681137837.txt
✅ Bash Tool: File verified

cc @Mossaka @Copilot

AI generated by Smoke Copilot

…put-to-npm-audit

github-actions · 2026-02-04T20:00:46Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-04T20:00:46Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-04T20:03:31Z

Smoke Test Results

Last 2 merged PRs:

chore: upgrade agentic workflows to gh-aw v0.42.0 #512: chore: upgrade agentic workflows to gh-aw v0.42.0
fix: replace deprecated log_access directive with Squid 5+ syntax #506: fix: replace deprecated log_access directive with Squid 5+ syntax

Test Results:

✅ GitHub MCP: Retrieved PR data
✅ Playwright: Page title "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
✅ File Writing: Created test file
✅ Bash: Verified file content

Status: PASS

AI generated by Smoke Claude

github-actions · 2026-02-04T20:03:36Z

Smoke Test Results ✅

Last 2 Merged PRs:

chore: upgrade agentic workflows to gh-aw v0.42.0 #512: chore: upgrade agentic workflows to gh-aw v0.42.0
fix: replace deprecated log_access directive with Squid 5+ syntax #506: fix: replace deprecated log_access directive with Squid 5+ syntax

Test Results:

✅ GitHub MCP: Retrieved PR data successfully
✅ Playwright: Verified GitHub page title
✅ File Operations: Created and read test file
✅ Bash Tools: Executed commands successfully

Status: PASS

cc @Mossaka @Copilot

AI generated by Smoke Copilot

Initial plan

93569cf

Copilot AI assigned Copilot and Mossaka Jan 27, 2026

Copilot started work on behalf of Mossaka January 27, 2026 03:31 View session

feat(ci): add npm audit SARIF conversion and upload

50ebfa8

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add SARIF output to npm audit workflow~~ feat(ci): add SARIF output to npm audit workflow Jan 27, 2026

Copilot AI requested a review from Mossaka January 27, 2026 03:38

Copilot finished work on behalf of Mossaka January 27, 2026 03:38

Mossaka marked this pull request as ready for review January 30, 2026 20:49

Copilot started work on behalf of Mossaka January 30, 2026 20:49 View session

Copilot finished work on behalf of Mossaka January 30, 2026 20:54

Merge branch 'main' of https://github.com/github/gh-aw-firewall into …

97b10f8

…copilot/add-sarif-output-to-npm-audit

Mossaka requested changes Feb 4, 2026

View reviewed changes

fix(ci): add null safety check for npm audit vulnerabilities

15c8a63

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

github-actions bot added the smoke-copilot label Feb 4, 2026

Merge remote-tracking branch 'origin/main' into copilot/add-sarif-out…

137f57e

…put-to-npm-audit

github-actions bot added the smoke-claude label Feb 4, 2026

Mossaka merged commit eba6ce8 into main Feb 4, 2026
38 checks passed

Mossaka deleted the copilot/add-sarif-output-to-npm-audit branch February 4, 2026 20:14

Conversation

Copilot AI commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Workflow

Context

Approach

Files to Modify

Acceptance Criteria

References

Comments on the Issue (you are @copilot in this section)

Uh oh!

Mossaka commented Jan 30, 2026

Uh oh!

Copilot AI commented Jan 30, 2026

Uh oh!

github-advanced-security bot commented Jan 30, 2026

Uh oh!

Mossaka commented Feb 3, 2026

Uh oh!

Mossaka left a comment

Choose a reason for hiding this comment

Review: REQUEST_CHANGES

Issue: Missing Null Safety Check

Required Fix

Minor Suggestion

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions bot commented Feb 4, 2026

Smoke Test Results - Claude Engine

Uh oh!

github-actions bot commented Feb 4, 2026

Smoke Test Results (Copilot) ✅ PASS

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 4, 2026

Smoke Test Results ✅

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 27, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading