refactor: remove sarif dependency and simplify version

Author: Patel230

.github/workflows/ci.yml

@@ -34,8 +34,6 @@ concurrency:
 env:
   GO_VERSION: "1.26.3"
   GOPROXY: "https://proxy.golang.org,direct"
-  GONOSUMCHECK: "github.com/GrayCodeAI/hawk/sarif"
-  GONOSUMDB: "github.com/GrayCodeAI/hawk/sarif"
 
 jobs:
   # -------------------------------------------------------------------------

README.md

@@ -105,7 +105,6 @@ exclude = ["/admin/*", "/api/*"]
 
 - Terminal (colored, human-readable)
 - JSON
-- SARIF (static analysis interchange)
 - JUnit XML (CI integration)
 - HTML report
 - Markdown
@@ -119,7 +118,7 @@ exclude = ["/admin/*", "/api/*"]
   with:
     url: https://staging.example.com
     fail-on: high
-    format: sarif
+    format: junit
 ```
 
 ### CLI

ci_output.go

@@ -7,9 +7,9 @@ import (
 )
 
 // CIOutput formats findings for CI/CD pipeline consumption.
-// Supports: GitHub Actions annotations, GitLab CI, SARIF, plain text.
+// Supports: GitHub Actions annotations, GitLab CI, plain text, JSON.
 type CIOutput struct {
-	Format string // "github", "gitlab", "sarif", "text", "json"
+	Format string // "github", "gitlab", "text", "json"
 }
 
 // FormatFindings converts findings to CI-friendly output.

cmd/inspect-ci/main.go

@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/GrayCodeAI/inspect"
-	reportpkg "github.com/GrayCodeAI/inspect/internal/report"
 )
 
 func main() {
@@ -33,7 +32,7 @@ func main() {
 	flag.IntVar(&depth, "depth", 5, "Maximum crawl depth")
 	flag.StringVar(&failOn, "fail-on", "high", "Minimum severity to fail")
 	flag.IntVar(&concurrency, "concurrency", 10, "Concurrent workers")
-	flag.StringVar(&format, "format", "terminal", "Output format: terminal, json, junit, sarif")
+	flag.StringVar(&format, "format", "terminal", "Output format: terminal, json, junit")
 	flag.StringVar(&timeout, "timeout", "5m", "Scan timeout")
 	flag.StringVar(&outputFile, "output-file", "", "Write report to file")
 	flag.Parse()
@@ -72,14 +71,8 @@ func main() {
 	case "json":
 		data, _ := json.MarshalIndent(report, "", "  ")
 		output = string(data)
-	case "sarif":
-		rd := toReportData(report)
-		sarif, sErr := reportpkg.FormatSARIF(rd)
-		if sErr != nil {
-			fmt.Fprintf(os.Stderr, "error: sarif format: %v\n", sErr)
-			os.Exit(1)
-		}
-		output = sarif
+	case "junit":
+		output = inspect.GenerateJUnit(report.Findings)
 	default:
 		output = formatTerminal(report)
 	}
@@ -113,30 +106,6 @@ func main() {
 	}
 }
 
-func toReportData(r *inspect.Report) reportpkg.ReportData {
-	var rd reportpkg.ReportData
-	rd.Target = r.Target
-	rd.CrawledURLs = r.CrawledURLs
-	rd.Duration = r.Duration
-	rd.Stats.BySeverity = make(map[string]int)
-	for sev, count := range r.Stats.BySeverity {
-		rd.Stats.BySeverity[sev.String()] = count
-	}
-	rd.Stats.ByCheck = r.Stats.ByCheck
-	for _, f := range r.Findings {
-		rd.Findings = append(rd.Findings, reportpkg.Finding{
-			Check:    f.Check,
-			Severity: reportpkg.Severity(f.Severity),
-			URL:      f.URL,
-			Element:  f.Element,
-			Message:  f.Message,
-			Fix:      f.Fix,
-			Evidence: f.Evidence,
-		})
-	}
-	return rd
-}
-
 func formatTerminal(r *inspect.Report) string {
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("Inspect: %s — %d pages, %d findings\n",

go.mod

@@ -2,14 +2,12 @@
 //
 // The Version variable is sourced at compile time from the VERSION file at
 // the repo root — the single source of truth used by release tooling
-// (release-please, goreleaser), CI, and SARIF/JUnit/JSON output drivers.
+// (release-please, goreleaser), and CI.
 package inspect
 
 import (
 	_ "embed"
 	"strings"
-
-	"github.com/GrayCodeAI/inspect/internal/report"
 )
 
 //go:embed VERSION
@@ -18,9 +16,3 @@ var versionFile string
 // Version of the inspect library. Do not edit this variable directly — bump
 // the VERSION file at the repo root instead.
 var Version = strings.TrimSpace(versionFile)
-
-func init() {
-	// Propagate canonical version into the internal/report package so the
-	// SARIF tool driver field reflects the real version.
-	report.SetToolVersion(Version)
-}