From f76e0a2de44dac6b7b0adff831b0c231cbbe8ba1 Mon Sep 17 00:00:00 2001 From: Copilot CLI Date: Wed, 3 Jun 2026 21:32:14 +0530 Subject: [PATCH] ci(binskim): drop invalid 'suppressions' on toolConfigurationNotifications SARIF 2.1.0 disallows 'suppressions' on toolConfigurationNotifications (only allowed on results). Adding it caused GitHub's SARIF upload for binskim-go to fail with: 'instance.runs[0].invocations[0].toolConfigurationNotifications[0] is not allowed to have the additional property suppressions'. Move the audit-trail justification into the notification's message.text instead; the canonical record lives in binskim_suppressions.json. The level is still demoted to 'note' and executionSuccessful is still flipped to true when no error/warning notifications remain. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- scripts/security/filter_binskim_sarif.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/scripts/security/filter_binskim_sarif.py b/scripts/security/filter_binskim_sarif.py index dcc80ed..33dc67e 100644 --- a/scripts/security/filter_binskim_sarif.py +++ b/scripts/security/filter_binskim_sarif.py @@ -126,13 +126,19 @@ def _normalize_invocations(sarif: dict, notif_suppressions: list[dict]) -> int: if not matched: continue notif["level"] = "note" - notif.setdefault("suppressions", []).append( - { - "kind": "external", - "status": "accepted", - "justification": matched.get("reason", ""), - } - ) + # NOTE: SARIF 2.1.0 does not allow `suppressions` on + # toolConfigurationNotifications (only on results). The audit + # trail lives in binskim_suppressions.json; here we just record + # the justification in the notification message for visibility. + reason = matched.get("reason", "") + if reason: + msg = notif.setdefault("message", {}) + base_text = msg.get("text") or msg.get("id", "") + msg["text"] = ( + f"{base_text}\n[binskim_suppressions.json] {reason}" + if base_text + else f"[binskim_suppressions.json] {reason}" + ) demoted += 1 remaining_errors = sum( 1