Add SARIF output + release/provenance workflow (review #6)

- `reir report-pr --sarif` emits SARIF 2.1.0 (missing capability = error, excess
  = warning, with source locations from evidence). The action now also writes a
  SARIF file and exposes it as a `sarif` output, so a workflow can upload it via
  github/codeql-action/upload-sarif for inline PR / code-scanning annotations.
- .github/workflows/release.yml builds pinned, checksummed rss + reir binaries
  on tag with actions/attest-build-provenance — the trust artifact a gate should
  pin to instead of @main / ambient PATH tools (verify with gh attestation verify).
- test: SARIF reports a missing capability as an error result.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

.github/actions/rsscript-review/action.yml

@@ -43,6 +43,9 @@ outputs:
   comment:
     description: 'The review comment text'
     value: ${{ steps.review.outputs.comment }}
+  sarif:
+    description: 'SARIF 2.1.0 output path (upload via github/codeql-action/upload-sarif for inline PR annotations)'
+    value: ${{ steps.review.outputs.sarif }}
   ci_json:
     description: 'CI gate JSON output path'
     value: ${{ steps.review.outputs.ci_json }}
@@ -153,6 +156,17 @@ runs:
         fi
         echo "ci_json=$CI_JSON_FILE" >> "$GITHUB_OUTPUT"
 
+        # SARIF for GitHub code scanning / inline PR annotations.
+        SARIF_FILE="$TEMP_DIR/rsscript-review.sarif"
+        reir report-pr \
+          --required "$REQUIRED_REIR_JSON" \
+          --granted "$INPUT_GRANTS" \
+          --target "$INPUT_TARGET" \
+          --sarif > "$SARIF_FILE" 2>/dev/null || true
+        if [ -s "$SARIF_FILE" ]; then
+          echo "sarif=$SARIF_FILE" >> "$GITHUB_OUTPUT"
+        fi
+
         if [ -s "$CI_JSON_FILE" ]; then
           REVIEW_STATUS=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("status","unknown"))' "$CI_JSON_FILE")
         elif [ $EXIT_CODE -ne 0 ]; then

.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Release
+
+# Build pinned, checksummed `rss` + `reir` binaries with build provenance on tag.
+# This is the trust artifact a supply-chain gate should pin to (instead of @main
+# / ambient PATH tools): download the release binary, verify the checksum, and
+# verify provenance with `gh attestation verify`.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build release binaries
+        run: |
+          cargo build --release --bin rss -p rsscript
+          cargo build --release --bin reir -p reir
+          mkdir -p dist
+          cp target/release/rss dist/rss-linux-x86_64
+          cp target/release/reir dist/reir-linux-x86_64
+
+      - name: Checksums
+        working-directory: dist
+        run: sha256sum rss-linux-x86_64 reir-linux-x86_64 > SHA256SUMS
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            dist/rss-linux-x86_64
+            dist/reir-linux-x86_64
+
+      - name: Upload release assets
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/rss-linux-x86_64
+            dist/reir-linux-x86_64
+            dist/SHA256SUMS

reir/src/format.rs

@@ -494,6 +494,95 @@ pub fn format_ci_gate_json(output: &CiGateOutput) -> String {
     serde_json::to_string_pretty(output).unwrap_or_else(|e| format!("{{\"error\": \"{e}\"}}"))
 }
 
+/// Render reconciliation results as SARIF 2.1.0 so CI can upload them to GitHub
+/// code scanning and get inline PR annotations. Missing capabilities are errors;
+/// excess grants are warnings.
+pub fn format_sarif(reconciliations: &[Reconciliation]) -> String {
+    let mut results = Vec::new();
+    for reconciliation in reconciliations {
+        let (rule_id, level) = match reconciliation.kind {
+            ReconciliationKind::MissingCapability => ("missing_capability", "error"),
+            ReconciliationKind::ExcessCapability => ("excess_capability", "warning"),
+            _ => continue,
+        };
+        let capability = reconciliation
+            .capability
+            .as_ref()
+            .map(|capability| {
+                let mut parts = vec![format!("{:?}", capability.category)];
+                for field in [&capability.provider, &capability.service, &capability.action] {
+                    if let Some(value) = field {
+                        parts.push(value.clone());
+                    }
+                }
+                parts.join(" / ")
+            })
+            .unwrap_or_else(|| "capability".to_string());
+        let text = match reconciliation.kind {
+            ReconciliationKind::MissingCapability => {
+                format!("Required capability not granted by target: {capability}")
+            }
+            ReconciliationKind::ExcessCapability => {
+                format!("Granted capability exceeds requirements (over-privilege): {capability}")
+            }
+            _ => unreachable!(),
+        };
+        let mut result = serde_json::json!({
+            "ruleId": rule_id,
+            "level": level,
+            "message": { "text": text },
+        });
+        // Attach a source location when the evidence carries one.
+        if let Some(evidence) = reconciliation
+            .evidence
+            .iter()
+            .find(|evidence| evidence.file.is_some())
+        {
+            let uri = evidence.file.clone().unwrap_or_default();
+            let mut region = serde_json::Map::new();
+            if let Some(line) = evidence.line {
+                region.insert("startLine".to_string(), serde_json::json!(line.max(1)));
+            }
+            if let Some(column) = evidence.column {
+                region.insert("startColumn".to_string(), serde_json::json!(column.max(1)));
+            }
+            result["locations"] = serde_json::json!([{
+                "physicalLocation": {
+                    "artifactLocation": { "uri": uri },
+                    "region": serde_json::Value::Object(region),
+                }
+            }]);
+        }
+        results.push(result);
+    }
+
+    let bundle = serde_json::json!({
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [{
+            "tool": {
+                "driver": {
+                    "name": "rsscript-reir",
+                    "informationUri": "https://github.com/Haofei/rsscript",
+                    "version": env!("CARGO_PKG_VERSION"),
+                    "rules": [
+                        {
+                            "id": "missing_capability",
+                            "shortDescription": { "text": "Required capability is not granted by the deployment target." }
+                        },
+                        {
+                            "id": "excess_capability",
+                            "shortDescription": { "text": "Granted capability exceeds what the code requires (over-privilege)." }
+                        }
+                    ]
+                }
+            },
+            "results": results,
+        }]
+    });
+    serde_json::to_string_pretty(&bundle).unwrap_or_else(|e| format!("{{\"error\": \"{e}\"}}"))
+}
+
 fn is_capability_fact(fact: &Fact, role: FactRole) -> bool {
     fact.kind == FactKind::Capability && fact.role == Some(role) && fact.capability.is_some()
 }
@@ -1534,6 +1623,17 @@ mod tests {
         assert_eq!(strict.status, CiGateStatus::Fail);
     }
 
+    #[test]
+    fn sarif_reports_missing_capability_as_error() {
+        let sarif = format_sarif(&[missing_reconciliation()]);
+        let value: serde_json::Value = serde_json::from_str(&sarif).expect("valid SARIF JSON");
+        assert_eq!(value["version"], "2.1.0");
+        let results = value["runs"][0]["results"].as_array().expect("results array");
+        assert_eq!(results.len(), 1);
+        assert_eq!(results[0]["ruleId"], "missing_capability");
+        assert_eq!(results[0]["level"], "error");
+    }
+
     #[test]
     fn error_diagnostic_makes_bundle_invalid_for_gating() {
         let required = capability_fact("fact.req", FactRole::Required, FactValue::True);

reir/src/main.rs

@@ -305,6 +305,7 @@ fn try_run_report_pr(args: &[String]) -> Result<(ExitCode, String), CliError> {
     let mut granted = None;
     let mut target = None;
     let mut ci_json = false;
+    let mut sarif = false;
     let mut policy_file = None;
     // CLI flag overrides, layered on top of any --policy file.
     let mut cli = reir::TargetGatePolicy::default();
@@ -317,6 +318,7 @@ fn try_run_report_pr(args: &[String]) -> Result<(ExitCode, String), CliError> {
             "--target" => target = Some(take_value(args, &mut index, "--target")?),
             "--policy" => policy_file = Some(take_value(args, &mut index, "--policy")?),
             "--ci-json" => ci_json = true,
+            "--sarif" => sarif = true,
             "--fail-on-unknown" => cli.fail_on_unknown = Some(true),
             "--fail-on-excess" => cli.fail_on_excess = Some(true),
             "--require-verified-capabilities" => {
@@ -361,7 +363,9 @@ fn try_run_report_pr(args: &[String]) -> Result<(ExitCode, String), CliError> {
         &reconciliations,
         policy,
     );
-    let output = if ci_json {
+    let output = if sarif {
+        reir::format_sarif(&reconciliations)
+    } else if ci_json {
         reir::format_ci_gate_json(&ci_output)
     } else {
         format_pr_review_comment(