merge all .sarif files at the end of the QL-for-QL workflow

Author: erik-krogh

.github/workflows/ql-for-ql-build.yml

@@ -50,9 +50,6 @@ jobs:
           path: ${{ runner.temp }}/query-pack.zip
 
   extractors:
-    strategy:
-      fail-fast: false
-
     runs-on: ubuntu-latest
 
     steps:
@@ -201,3 +198,27 @@ jobs:
           name: ${{ matrix.folder }}.sarif
           path: ${{ matrix.folder }}.sarif
 
+  combine:
+    runs-on: ubuntu-latest
+    needs:
+      - analyze
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Make a folder for artifacts. 
+        run: mkdir -p results
+      - name: Download all sarif files
+        uses: actions/download-artifact@v3
+        with: 
+            path: results
+      - uses: actions/setup-node@v3
+        with:
+            node-version: 16
+      - name: Combine all sarif files
+        run: | 
+          node ./ql/scripts/merge-sarif.js results/**/*.sarif combined.sarif
+      - name: Upload combined sarif file
+        uses: actions/upload-artifact@v3
+        with:
+            name: combined.sarif
+            path: combined.sarif

ql/scripts/merge-sarif.js

@@ -0,0 +1,26 @@
+var fs = require("fs");
+
+// first a  list of files to merge, and the last argument is the output file.
+async function main(files) {
+  const inputs = files
+    .slice(0, -1)
+    .map((file) => fs.readFileSync(file))
+    .map((data) => JSON.parse(data));
+  const out = inputs[0]; // just arbitrarily take the first one
+  const outFile = files[files.length - 1];
+
+  const combinedResults = [];
+
+  for (const sarif of inputs) {
+    combinedResults.push(...sarif.runs[0].results);
+  }
+
+  out.runs[0].artifacts = []; // the indexes in these won't make sense, so I hope this works.
+  out.runs[0].results = combinedResults;
+
+  // workaround until https://github.com/microsoft/sarif-vscode-extension/pull/436/ is part of a release
+  out["$schema"] = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0"; 
+
+  fs.writeFileSync(outFile, JSON.stringify(out, null, 2));
+}
+main(process.argv.splice(2));