chore(sarif): Bump go-sarif version

[javirln]

This pull request updates the handling of SARIF files in the attestation crafter, improving compatibility with SARIF v3, enhancing annotation extraction, and updating dependencies accordingly. It also refines test cases and adds a new SARIF test file.

Dependency updates:

• Updated to use github.com/owenrumney/go-sarif/v3 (v3.3.0) instead of the older v1.1.1, and changed import paths in sarif.go to match the new version. [1] [2] [3]
• Added github.com/xeipuuv/gojsonschema v1.2.0 as an indirect dependency.

SARIF file handling improvements:

• Improved error handling in Craft() for SARIF files by including the underlying error in the returned message and clarifying schema validation.
• Refactored annotation extraction in injectAnnotations() to handle pointer fields and missing data safely, ensuring tool name and version are correctly extracted from SARIF v3 files.

Testing improvements:

• Updated test structure in sarif_test.go to allow for expected digest and name assertions, and removed an outdated test case. [1] [2] [3]
• Added a new SARIF test file with control characters to testdata for more robust test coverage.

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/materials/sarif.go">

<violation number="1" location="pkg/attestation/crafter/materials/sarif.go:155">
P1: Guard `run.tool` and `run.tool.driver` before dereferencing to avoid a panic on partially populated SARIF runs.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[migmartri]

I am worried that this will become a precedent of us modifying a file before uploading it, changing digest, can't we fix the generator instead?

[javirln]

I am worried that this will become a precedent of us modifying a file before uploading it, changing digest, can't we fix the generator instead?

We definitely don't modify any incoming file, I'll revert those changes