adds severity mapping

Author: kkartunov

.github/workflows/opengrep.yaml

@@ -27,7 +27,44 @@ jobs:
         run: |
           /home/runner/.opengrep/cli/latest/opengrep --config=r/all --sarif-output=opengrep-results.sarif --verbose .
 
+      - name: Fix SARIF severity values
+        run: |
+          python3 << 'EOF'
+          import json
+
+          # Load SARIF file
+          with open('opengrep-results.sarif', 'r') as f:
+              sarif = json.load(f)
+
+          # Map text severity to numeric values
+          severity_map = {
+              'CRITICAL': '9.0',
+              'HIGH': '7.0',
+              'MEDIUM': '5.0',
+              'LOW': '3.0',
+              'WARNING': '5.0',
+              'ERROR': '7.0',
+              'INFO': '1.0',
+              'NOTE': '1.0'
+          }
+
+          # Fix security-severity values
+          for run in sarif.get('runs', []):
+              for rule in run.get('tool', {}).get('driver', {}).get('rules', []):
+                  if 'properties' in rule and 'security-severity' in rule['properties']:
+                      severity = rule['properties']['security-severity']
+                      if isinstance(severity, str) and severity.upper() in severity_map:
+                          rule['properties']['security-severity'] = severity_map[severity.upper()]
+
+          # Save fixed SARIF
+          with open('opengrep-results.sarif', 'w') as f:
+              json.dump(sarif, f, indent=2)
+
+          print("✓ Fixed SARIF severity values")
+          EOF
+
       - name: Upload OpenGrep scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
+        if: always()
         with:
           sarif_file: "opengrep-results.sarif"