feat: replace go-sarif with internal SARIF implementation (#113)

* docs: add design for replacing go-sarif with internal implementation

Removes external dependency chain (go-sarif → testify → yaml.v3) by
implementing a minimal internal SARIF package with support for v2.1.0
and v3.0 output formats.

* docs: add implementation plan for replacing go-sarif

11 tasks covering:
- testjson parser with all 7 fields
- internal SARIF model and version registry
- v2.1.0 and v2.2 serializers
- converter refactoring
- CLI with --sarif-version and --pretty flags
- dependency cleanup

* feat(testjson): add parser for go test -json output

Add TestEvent struct with all 7 fields from go test -json and
ParseFile function to parse test output files line by line.

* test(testjson): add tests for all fields, malformed JSON, file not found

* feat(sarif): add internal SARIF data model

* feat(sarif): add version registry (serializers pending)

Add version registry infrastructure for SARIF serialization:
- Version type and constants (2.1.0, 2.2)
- DefaultVersion set to 2.1.0
- Register() function for version-specific serializers
- Serialize() function with pretty-print support
- SupportedVersions() for listing registered versions

Note: TestSupportedVersions will fail until serializers are
registered via init() functions in v21.go and v22.go (Tasks 5/6).

* feat(sarif): add SARIF v2.1.0 serializer

* feat(sarif): add SARIF v2.2 serializer

* test(sarif): add pretty print test

* refactor(converter): use internal sarif and testjson packages

Replace external go-sarif library with internal packages:
- Use internal/sarif for SARIF model and serialization
- Use internal/testjson for Go test JSON parsing
- Add ConvertOptions struct with SARIFVersion and Pretty options
- Remove external github.com/owenrumney/go-sarif/v2 dependency

* feat(cli): add --sarif-version and --pretty flags

* fix(lint): resolve golangci-lint errors

Fix errcheck violation by properly handling f.Close() error return value
and add proper package comments to satisfy revive linter.

* refactor: consolidate SARIF serializers and fix code issues

- Extract shared SARIF types and serialization logic into serialize.go
- Simplify v21.go and v22.go to thin wrappers (107/108 → 12 lines each)
- Add testConvertHelper() to reduce test duplication in converter_test.go
- Remove redundant nested check in converter.go (outer condition already guarantees non-empty)
- Fix LogicalLocations: avoid leading dot when Module is empty, set Kind correctly
- Increase scanner buffer in parser.go from 64KB to 4MB for large JSON lines
- Extract test constants to reduce string literal duplication

* docs: fix SARIF v3.0 references to v2.2

SARIF v3.0 doesn't exist. Update design and implementation docs
to correctly reference v2.1.0 and v2.2 throughout.

* fix: update SARIF 2.2 schema URL and add markdown language identifiers

Update schema URL to point to accessible prerelease location and add
language identifiers to fenced code blocks to resolve MD040 violations.

* chore: add pre-commit config and fix config file formatting

Add pre-commit configuration and fix formatting issues in config files
including trailing whitespace, YAML document markers, and JSON formatting.

* docs: fix markdown linting issues in implementation plan

- Convert bold step markers to proper headings
- Fix line length violations in header section
- Add markdownlint config to allow duplicate sibling headings
- Add ecrc config to exclude plan docs from editorconfig checking

* chore: update MegaLinter configuration

Configure specific linters and add exclusion patterns for test data
and generated files.

* docs: fix filename in design doc (writer.go → serialize.go)

* refactor(tests): fix SonarCloud code quality issues

Extract helper functions to reduce cognitive complexity in TestRun and
consolidate duplicate string literals into shared testutil package.

* docs: add docstrings to exported variables and struct fields

Add documentation comments to reach ~98% docstring coverage:
- cmd/main.go: document build-time variables
- internal/converter.go: document ConvertOptions fields
- internal/sarif/model.go: document Report, Rule, Result, LogicalLocation fields
- internal/testjson/parser.go: document TestEvent fields

* fix(testjson): change FailedBuild field type from string to bool

The go test -json output emits FailedBuild as a boolean, not a string.
This was causing JSON unmarshal errors. Updated the struct field type
and corresponding test assertions.

* chore(ci): mega-linter config tweaks for revive

internal/sarif/model.go

@@ -0,0 +1,42 @@
+// Package sarif provides SARIF report generation.
+package sarif
+
+// Report is the internal version-agnostic representation of a SARIF report.
+type Report struct {
+	// ToolName is the name of the tool that produced the results.
+	ToolName string
+	// ToolInfoURI is a URL for more information about the tool.
+	ToolInfoURI string
+	// Rules contains the rule definitions referenced by results.
+	Rules []Rule
+	// Results contains the actual findings/test failures.
+	Results []Result
+}
+
+// Rule defines a rule that can be violated.
+type Rule struct {
+	// ID is the unique identifier for this rule.
+	ID string
+	// Description explains what this rule checks.
+	Description string
+}
+
+// Result represents a single finding.
+type Result struct {
+	// RuleID references the rule that produced this result.
+	RuleID string
+	// Level indicates the severity (error, warning, note).
+	Level string
+	// Message describes the specific issue found.
+	Message string
+	// Location identifies where the issue was found.
+	Location *LogicalLocation
+}
+
+// LogicalLocation identifies where an issue occurred without file coordinates.
+type LogicalLocation struct {
+	// Module is the Go module or package path.
+	Module string
+	// Function is the name of the function or test.
+	Function string
+}

internal/sarif/model_test.go

@@ -0,0 +1,43 @@
+// internal/sarif/model_test.go
+package sarif
+
+import "testing"
+
+const (
+	testToolName   = "test-tool"
+	testModuleName = "example.com/foo"
+)
+
+func TestReport_Structure(t *testing.T) {
+	report := &Report{
+		ToolName:    testToolName,
+		ToolInfoURI: "https://example.com",
+		Rules: []Rule{
+			{ID: "rule-1", Description: "Test rule"},
+		},
+		Results: []Result{
+			{
+				RuleID:  "rule-1",
+				Level:   "error",
+				Message: "Test failed",
+				Location: &LogicalLocation{
+					Module:   testModuleName,
+					Function: "TestBar",
+				},
+			},
+		},
+	}
+
+	if report.ToolName != testToolName {
+		t.Errorf("ToolName = %q, want %q", report.ToolName, testToolName)
+	}
+	if len(report.Rules) != 1 {
+		t.Errorf("len(Rules) = %d, want %d", len(report.Rules), 1)
+	}
+	if len(report.Results) != 1 {
+		t.Errorf("len(Results) = %d, want %d", len(report.Results), 1)
+	}
+	if report.Results[0].Location.Module != testModuleName {
+		t.Errorf("Location.Module = %q, want %q", report.Results[0].Location.Module, testModuleName)
+	}
+}

internal/sarif/serialize.go

@@ -0,0 +1,107 @@
+package sarif
+
+import "encoding/json"
+
+// Internal SARIF document structure (version-agnostic)
+type sarifDoc struct {
+	Schema  string `json:"$schema"`
+	Version string `json:"version"`
+	Runs    []run  `json:"runs"`
+}
+
+type run struct {
+	Tool    tool     `json:"tool"`
+	Results []result `json:"results"`
+}
+
+type tool struct {
+	Driver driver `json:"driver"`
+}
+
+type driver struct {
+	Name           string `json:"name"`
+	InformationURI string `json:"informationUri,omitempty"`
+	Rules          []rule `json:"rules,omitempty"`
+}
+
+type rule struct {
+	ID               string  `json:"id"`
+	ShortDescription message `json:"shortDescription,omitempty"`
+}
+
+type result struct {
+	RuleID           string            `json:"ruleId"`
+	Level            string            `json:"level"`
+	Message          message           `json:"message"`
+	LogicalLocations []logicalLocation `json:"logicalLocations,omitempty"`
+}
+
+type message struct {
+	Text string `json:"text"`
+}
+
+type logicalLocation struct {
+	FullyQualifiedName string `json:"fullyQualifiedName,omitempty"`
+	Kind               string `json:"kind,omitempty"`
+}
+
+// serializeWithVersion creates SARIF JSON with specified schema and version
+func serializeWithVersion(r *Report, schema, version string) ([]byte, error) {
+	doc := sarifDoc{
+		Schema:  schema,
+		Version: version,
+		Runs:    []run{buildRun(r)},
+	}
+	return json.Marshal(doc)
+}
+
+func buildRun(r *Report) run {
+	rn := run{
+		Tool: tool{
+			Driver: driver{
+				Name:           r.ToolName,
+				InformationURI: r.ToolInfoURI,
+			},
+		},
+		Results: make([]result, 0, len(r.Results)),
+	}
+
+	for _, rl := range r.Rules {
+		rn.Tool.Driver.Rules = append(rn.Tool.Driver.Rules, rule{
+			ID:               rl.ID,
+			ShortDescription: message{Text: rl.Description},
+		})
+	}
+
+	for _, res := range r.Results {
+		r := result{
+			RuleID:  res.RuleID,
+			Level:   res.Level,
+			Message: message{Text: res.Message},
+		}
+
+		if res.Location != nil {
+			var fqn, kind string
+			switch {
+			case res.Location.Module != "" && res.Location.Function != "":
+				fqn = res.Location.Module + "." + res.Location.Function
+				kind = "function"
+			case res.Location.Function != "":
+				fqn = res.Location.Function
+				kind = "function"
+			case res.Location.Module != "":
+				fqn = res.Location.Module
+				kind = "module"
+			}
+			if fqn != "" {
+				r.LogicalLocations = []logicalLocation{
+					{FullyQualifiedName: fqn, Kind: kind},
+				}
+			}
+		}
+
+		rn.Results = append(rn.Results, r)
+	}
+
+	return rn
+}

internal/sarif/v21.go

@@ -0,0 +1,12 @@
+// Package sarif provides SARIF report generation.
+package sarif
+
+func init() {
+	Register(Version210, serializeV21)
+}
+
+func serializeV21(r *Report) ([]byte, error) {
+	return serializeWithVersion(r,
+		"https://json.schemastore.org/sarif-2.1.0.json",
+		"2.1.0")
+}

internal/sarif/v21_test.go

@@ -0,0 +1,127 @@
+// internal/sarif/v21_test.go
+package sarif
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+const (
+	testRuleID     = "test-failure"
+	testLevelError = "error"
+)
+
+func TestSerializeV21_Schema(t *testing.T) {
+	report := &Report{
+		ToolName:    testToolName,
+		ToolInfoURI: "https://example.com",
+	}
+
+	data, err := Serialize(report, Version210, false)
+	if err != nil {
+		t.Fatalf("Serialize returned error: %v", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(data, &result); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+
+	if result["$schema"] != "https://json.schemastore.org/sarif-2.1.0.json" {
+		t.Errorf("$schema = %v, want %v", result["$schema"], "https://json.schemastore.org/sarif-2.1.0.json")
+	}
+	if result["version"] != "2.1.0" {
+		t.Errorf("version = %v, want %v", result["version"], "2.1.0")
+	}
+}
+
+func TestSerializeV21_WithResults(t *testing.T) {
+	report := &Report{
+		ToolName:    "go-test-sarif",
+		ToolInfoURI: "https://golang.org/cmd/go/",
+		Rules: []Rule{
+			{ID: testRuleID, Description: "Test failure"},
+		},
+		Results: []Result{
+			{
+				RuleID:  testRuleID,
+				Level:   testLevelError,
+				Message: "TestFoo failed",
+			},
+		},
+	}
+
+	data, err := Serialize(report, Version210, false)
+	if err != nil {
+		t.Fatalf("Serialize returned error: %v", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(data, &result); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+
+	runs, ok := result["runs"].([]interface{})
+	if !ok || len(runs) != 1 {
+		t.Fatalf("expected 1 run, got %v", result["runs"])
+	}
+
+	run := runs[0].(map[string]interface{})
+	results, ok := run["results"].([]interface{})
+	if !ok || len(results) != 1 {
+		t.Fatalf("expected 1 result, got %v", run["results"])
+	}
+
+	res := results[0].(map[string]interface{})
+	if res["ruleId"] != testRuleID {
+		t.Errorf("ruleId = %v, want %v", res["ruleId"], testRuleID)
+	}
+	if res["level"] != testLevelError {
+		t.Errorf("level = %v, want %v", res["level"], testLevelError)
+	}
+}
+
+func TestSerializeV21_LogicalLocation(t *testing.T) {
+	report := &Report{
+		ToolName: "go-test-sarif",
+		Rules: []Rule{
+			{ID: testRuleID, Description: "Test failure"},
+		},
+		Results: []Result{
+			{
+				RuleID:  testRuleID,
+				Level:   testLevelError,
+				Message: "TestBar failed",
+				Location: &LogicalLocation{
+					Module:   testModuleName,
+					Function: "TestBar",
+				},
+			},
+		},
+	}
+
+	data, err := Serialize(report, Version210, false)
+	if err != nil {
+		t.Fatalf("Serialize returned error: %v", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(data, &result); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+
+	runs := result["runs"].([]interface{})
+	run := runs[0].(map[string]interface{})
+	results := run["results"].([]interface{})
+	res := results[0].(map[string]interface{})
+
+	locs, ok := res["logicalLocations"].([]interface{})
+	if !ok || len(locs) != 1 {
+		t.Fatalf("expected 1 logicalLocation, got %v", res["logicalLocations"])
+	}
+
+	loc := locs[0].(map[string]interface{})
+	if loc["fullyQualifiedName"] != "example.com/foo.TestBar" {
+		t.Errorf("fullyQualifiedName = %v, want %v", loc["fullyQualifiedName"], "example.com/foo.TestBar")
+	}
+}

internal/sarif/v22.go

@@ -0,0 +1,12 @@
+// Package sarif provides SARIF report generation.
+package sarif
+
+func init() {
+	Register(Version22, serializeV22)
+}
+
+func serializeV22(r *Report) ([]byte, error) {
+	return serializeWithVersion(r,
+		"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/2.2-prerelease-2024-08-08/sarif-2.2/schema/sarif-2-2.schema.json",
+		"2.2")
+}

internal/sarif/v22_test.go

@@ -0,0 +1,74 @@
+// internal/sarif/v22_test.go
+package sarif
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestSerializeV22_Schema(t *testing.T) {
+	report := &Report{
+		ToolName:    testToolName,
+		ToolInfoURI: "https://example.com",
+	}
+
+	data, err := Serialize(report, Version22, false)
+	if err != nil {
+		t.Fatalf("Serialize returned error: %v", err)
+	}
+
+	var result map[string]any
+	if err := json.Unmarshal(data, &result); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+
+	if result["$schema"] != "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/2.2-prerelease-2024-08-08/sarif-2.2/schema/sarif-2-2.schema.json" {
+		t.Errorf("$schema = %v", result["$schema"])
+	}
+	if result["version"] != "2.2" {
+		t.Errorf("version = %v, want %v", result["version"], "2.2")
+	}
+}
+
+func TestSerializeV22_WithResults(t *testing.T) {
+	report := &Report{
+		ToolName: "go-test-sarif",
+		Rules: []Rule{
+			{ID: testRuleID, Description: "Test failure"},
+		},
+		Results: []Result{
+			{
+				RuleID:  testRuleID,
+				Level:   testLevelError,
+				Message: "TestFoo failed",
+				Location: &LogicalLocation{
+					Module:   testModuleName,
+					Function: "TestFoo",
+				},
+			},
+		},
+	}
+
+	data, err := Serialize(report, Version22, false)
+	if err != nil {
+		t.Fatalf("Serialize returned error: %v", err)
+	}
+
+	var result map[string]any
+	if err := json.Unmarshal(data, &result); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+
+	runs := result["runs"].([]any)
+	run := runs[0].(map[string]any)
+	results := run["results"].([]any)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+
+	res := results[0].(map[string]any)
+	if res["ruleId"] != testRuleID {
+		t.Errorf("ruleId = %v, want %v", res["ruleId"], testRuleID)
+	}
+}

internal/sarif/version.go

@@ -0,0 +1,66 @@
+// Package sarif provides SARIF report generation.
+package sarif
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"sort"
+)
+
+// Version represents a SARIF specification version.
+type Version string
+
+const (
+	// Version210 is SARIF version 2.1.0.
+	Version210 Version = "2.1.0"
+	// Version22 is SARIF version 2.2.
+	Version22 Version = "2.2"
+)
+
+// DefaultVersion is the default SARIF version used when not specified.
+const DefaultVersion = Version210
+
+// Serializer converts an internal Report to version-specific JSON.
+type Serializer func(*Report) ([]byte, error)
+
+var serializers = map[Version]Serializer{}
+
+// Register adds a serializer for a SARIF version.
+// Called by version-specific files in their init() functions.
+func Register(v Version, s Serializer) {
+	serializers[v] = s
+}
+
+// Serialize converts a Report to JSON for the specified SARIF version.
+func Serialize(r *Report, v Version, pretty bool) ([]byte, error) {
+	s, ok := serializers[Version(v)]
+	if !ok {
+		return nil, fmt.Errorf("unsupported SARIF version: %s", v)
+	}
+
+	data, err := s(r)
+	if err != nil {
+		return nil, err
+	}
+
+	if pretty {
+		var buf bytes.Buffer
+		if err := json.Indent(&buf, data, "", "  "); err != nil {
+			return nil, err
+		}
+		return buf.Bytes(), nil
+	}
+
+	return data, nil
+}
+
+// SupportedVersions returns all registered SARIF versions, sorted.
+func SupportedVersions() []string {
+	versions := make([]string, 0, len(serializers))
+	for v := range serializers {
+		versions = append(versions, string(v))
+	}
+	sort.Strings(versions)
+	return versions
+}

internal/sarif/version_test.go

@@ -0,0 +1,83 @@
+// internal/sarif/version_test.go
+package sarif
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestSupportedVersions(t *testing.T) {
+	versions := SupportedVersions()
+
+	if len(versions) < 2 {
+		t.Errorf("expected at least 2 versions, got %d", len(versions))
+	}
+
+	// Should contain 2.1.0 and 2.2
+	found210 := false
+	found22 := false
+	for _, v := range versions {
+		if v == "2.1.0" {
+			found210 = true
+		}
+		if v == "2.2" {
+			found22 = true
+		}
+	}
+
+	if !found210 {
+		t.Error("SupportedVersions should contain 2.1.0")
+	}
+	if !found22 {
+		t.Error("SupportedVersions should contain 2.2")
+	}
+}
+
+func TestSerialize_UnknownVersion(t *testing.T) {
+	report := &Report{ToolName: "test"}
+
+	_, err := Serialize(report, "9.9.9", false)
+	if err == nil {
+		t.Fatal("expected error for unknown version, got nil")
+	}
+
+	if !strings.Contains(err.Error(), "unsupported") {
+		t.Errorf("error = %q, want to contain %q", err.Error(), "unsupported")
+	}
+}
+
+func TestDefaultVersion(t *testing.T) {
+	if DefaultVersion != Version210 {
+		t.Errorf("DefaultVersion = %q, want %q", DefaultVersion, Version210)
+	}
+}
+
+func TestSerialize_PrettyOutput(t *testing.T) {
+	report := &Report{
+		ToolName: "test-tool",
+	}
+
+	compact, err := Serialize(report, Version210, false)
+	if err != nil {
+		t.Fatalf("Serialize compact returned error: %v", err)
+	}
+
+	pretty, err := Serialize(report, Version210, true)
+	if err != nil {
+		t.Fatalf("Serialize pretty returned error: %v", err)
+	}
+
+	// Pretty should be longer due to whitespace
+	if len(pretty) <= len(compact) {
+		t.Errorf("pretty output (%d bytes) should be longer than compact (%d bytes)", len(pretty), len(compact))
+	}
+
+	// Pretty should contain newlines and indentation
+	if !bytes.Contains(pretty, []byte("\n")) {
+		t.Error("pretty output should contain newlines")
+	}
+	if !bytes.Contains(pretty, []byte("  ")) {
+		t.Error("pretty output should contain indentation")
+	}
+}