Use robocop SARIF reports for GitHub Code Scanning integration

- Use --reports sarif for SARIF output (GitHub code scanning standard)
- Upload SARIF via github/codeql-action/upload-sarif for inline annotations
- Use --exit-zero so lint issues don't fail CI
- Use --reports text_file for PR comment readable output
- Add .sarif.json and robocop.txt to .gitignore

Author: HackXIt

.github/workflows/pr-feedback.yml

@@ -5,6 +5,7 @@ on:
 
 permissions:
   pull-requests: write
+  security-events: write
 
 jobs:
   test-and-comment:
@@ -32,8 +33,17 @@ jobs:
         id: robocop
         continue-on-error: true
         run: |
-          uv run robocop check tests/ resources/ 2>&1 | tee robocop-output.txt
-          echo "exit_code=$?" >> $GITHUB_OUTPUT
+          uv run robocop check \
+            --reports sarif,text_file \
+            --exit-zero \
+            tests/ resources/
+
+      - name: Upload SARIF to GitHub
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: .sarif.json
+          category: robocop-pr
 
       - name: Initialize Browser Library
         run: uv run rfbrowser init chromium
@@ -66,21 +76,28 @@ jobs:
             const testSummary = testLines.slice(-10).join('\n');
 
             // Read robocop output
-            let robocopOutput = '';
+            let robocopOutput = 'No issues found.';
             try {
-              robocopOutput = fs.readFileSync('robocop-output.txt', 'utf8').trim();
+              robocopOutput = fs.readFileSync('robocop.txt', 'utf8').trim() || 'No issues found.';
             } catch (e) {
-              robocopOutput = 'Could not read Robocop output.';
+              robocopOutput = 'No issues found.';
             }
 
             const testPassed = '${{ steps.tests.outcome }}' === 'success';
-            const robocopPassed = '${{ steps.robocop.outcome }}' === 'success';
-
             const testIcon = testPassed ? '✅' : '❌';
             const testStatus = testPassed ? 'All tests passed!' : 'Some tests failed.';
 
-            const robocopIcon = robocopPassed ? '✅' : '⚠️';
-            const robocopStatus = robocopPassed ? 'No issues found.' : 'Issues found — see details below.';
+            // Count robocop issues from SARIF
+            let issueCount = 0;
+            try {
+              const sarif = JSON.parse(fs.readFileSync('.sarif.json', 'utf8'));
+              issueCount = sarif.runs?.[0]?.results?.length || 0;
+            } catch (e) {}
+
+            const robocopIcon = issueCount === 0 ? '✅' : '⚠️';
+            const robocopStatus = issueCount === 0
+              ? 'No issues found.'
+              : `${issueCount} issue(s) found — see Code Scanning tab for details.`;
 
             const body = `## ${testIcon} Robot Framework Test Results
 
@@ -125,9 +142,11 @@ jobs:
           name: pr-robot-results
           path: results/
 
-      - name: Upload Robocop report
+      - name: Upload Robocop reports
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: pr-robocop-report
-          path: robocop-output.txt
+          name: pr-robocop-reports
+          path: |
+            .sarif.json
+            robocop.txt

.github/workflows/robot-tests.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  security-events: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -21,14 +24,21 @@ jobs:
         run: uv sync --locked
 
       - name: Run Robocop lint
-        run: uv run robocop check tests/ resources/ 2>&1 | tee robocop-output.txt
+        run: uv run robocop check --reports sarif --exit-zero tests/ resources/
+
+      - name: Upload SARIF to GitHub
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: .sarif.json
+          category: robocop
 
-      - name: Upload Robocop report
+      - name: Upload Robocop SARIF artifact
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: robocop-report
-          path: robocop-output.txt
+          name: robocop-sarif
+          path: .sarif.json
 
   robot-tests:
     runs-on: ubuntu-latest

.gitignore

@@ -28,3 +28,5 @@ site/
 # Robocop
 robocop.json
 .robocop_cache/
+*.sarif.json
+robocop.txt