Repository: detekt/detekt (kotlin)

Issue:
Stop using absolute paths in SARIF output
## Expected Behavior
Gradle task output should be relocatable. The SARIF report output should not include any absolute paths in its output.

## Current Behavior
<!--- If suggesting a change/improvement, explain the difference from the current behavior -->
We use absolute paths in SARIF report output. When this report output is cached and the project under analysis is checked out under a different path the absolute path will not be valid.

## Context
Report output should be cacheable and avoid things like absolute file paths where possible. GitHub also ignores values set in the SARIF report and uses [other methods](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#specifying-the-root-for-source-files) to set the root path for source files:

> You can provide the source root for conversion from absolute to relative URIs in one of the following ways.
> 
> * [checkout_path](https://github.com/github/codeql-action/blob/c2c0a2908e95769d01b907f9930050ecb5cf050d/analyze/action.yml#L44-L47) input to the github/codeql-action/analyze action
> * checkout_uri parameter to the SARIF upload API endpoint. For more information, see "[REST API endpoints for code scanning](https://docs.github.com/en/rest/code-scanning/code-scanning#upload-an-analysis-as-sarif-data)."
> * [invocations[0].workingDirectory.uri](https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc9244365) property in the run object in the SARIF file

The last point above references [`workingDirectory` property](https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc10541024) which is probably more appropriate for our purposes, but also comes with the warning "Absolute path names can reveal information that might be sensitive" which we should also consider.

The SARIF spec says `uriBaseId` SHOULD be used when paths are relative, but this is not required, so we remain spec compliant and can rely on consumers doing the right thing if we rely exclusively on relative paths.

Relates to #7170

Pull request:
Absolute paths are not required here. The values are ignored by GitHub. Using `%srcroot%` for `artifactLocation.uriBaseId` is sufficient as a root path reference. The SARIF 2.1.0 Errata 01 spec says at s3.4.4:

> The analysis tool and the SARIF consumers have agreed upon a convention
> whereby this indicates that the relative reference is expressed relative
> to the root of the source tree in which the file appears.

Fixes #7665

I added a commit with failures which was properly rendered by GitHub analysis to show that the merged SARIF output is still doing what's expected. I've now removed the commit so this is ready to merge.

Patch:
diff --git a/detekt-report-sarif/src/main/kotlin/io/github/detekt/report/sarif/SarifOutputReport.kt b/detekt-report-sarif/src/main/kotlin/io/github/detekt/report/sarif/SarifOutputReport.kt
index de840499fe1e..810559ff85d0 100644
--- a/detekt-report-sarif/src/main/kotlin/io/github/detekt/report/sarif/SarifOutputReport.kt
+++ b/detekt-report-sarif/src/main/kotlin/io/github/detekt/report/sarif/SarifOutputReport.kt
@@ -1,6 +1,5 @@
 package io.github.detekt.report.sarif
 
-import io.github.detekt.sarif4k.ArtifactLocation
 import io.github.detekt.sarif4k.Run
 import io.github.detekt.sarif4k.SarifSchema210
 import io.github.detekt.sarif4k.SarifSerializer
@@ -13,8 +12,6 @@ import io.gitlab.arturbosch.detekt.api.OutputReport
 import io.gitlab.arturbosch.detekt.api.SetupContext
 import io.gitlab.arturbosch.detekt.api.internal.BuiltInOutputReport
 import io.gitlab.arturbosch.detekt.api.internal.whichDetekt
-import kotlin.io.path.Path
-import kotlin.io.path.invariantSeparatorsPathString
 
 const val SRCROOT = "%SRCROOT%"
 
@@ -23,14 +20,9 @@ class SarifOutputReport : BuiltInOutputReport, OutputReport() {
     override val ending: String = "sarif"
     override val id: String = "sarif"
 
-    private lateinit var basePath: String
     private lateinit var config: Config
 
     override fun init(context: SetupContext) {
-        this.basePath = context.basePath
-            .invariantSeparatorsPathString
-            .let { if (!it.endsWith("/")) "$it/" else it }
-
         this.config = context.config
     }
 
@@ -55,7 +47,6 @@ class SarifOutputReport : BuiltInOutputReport, OutputReport() {
                             version = version
                         )
                     ),
-                    originalURIBaseIDS = mapOf(SRCROOT to ArtifactLocation(uri = Path(basePath).toUri().toString())),
                     results = toResults(detektion)
                 )
             )


Test patch:
diff --git a/detekt-report-sarif/src/test/kotlin/io/github/detekt/report/sarif/SarifOutputReportSpec.kt b/detekt-report-sarif/src/test/kotlin/io/github/detekt/report/sarif/SarifOutputReportSpec.kt
index fdc675b5de35..f5b7f136e33a 100644
--- a/detekt-report-sarif/src/test/kotlin/io/github/detekt/report/sarif/SarifOutputReportSpec.kt
+++ b/detekt-report-sarif/src/test/kotlin/io/github/detekt/report/sarif/SarifOutputReportSpec.kt
@@ -18,8 +18,6 @@ import io.gitlab.arturbosch.detekt.test.yamlConfig
 import org.assertj.core.api.Assertions.assertThat
 import org.jetbrains.kotlin.psi.KtClassOrObject
 import org.junit.jupiter.api.Test
-import kotlin.io.path.Path
-import kotlin.io.path.absolute
 
 class SarifOutputReportSpec {
 
@@ -49,13 +47,11 @@ class SarifOutputReportSpec {
             )
         )
 
-        val basePath = Path("").absolute()
         val report = SarifOutputReport()
-            .apply { init(TestSetupContext(basePath = basePath)) }
+            .apply { init(TestSetupContext()) }
             .render(result)
 
         val expectedReport = readResourceContent("vanilla.sarif.json")
-            .replace("<BASE-URL>", basePath.toUri().toString())
 
         assertThat(report).isEqualToIgnoringWhitespace(expectedReport)
     }
@@ -70,13 +66,11 @@ class SarifOutputReportSpec {
 
         val testConfig = yamlConfig("config_with_rule_set_to_warning.yml")
 
-        val basePath = Path("").absolute()
         val report = SarifOutputReport()
-            .apply { init(TestSetupContext(config = testConfig, basePath = basePath)) }
+            .apply { init(TestSetupContext(config = testConfig)) }
             .render(result)
 
         val expectedReport = readResourceContent("rule_warning.sarif.json")
-            .replace("<BASE-PATH>", basePath.toUri().toString())
 
         assertThat(report).isEqualToIgnoringWhitespace(expectedReport)
     }
diff --git a/detekt-report-sarif/src/test/resources/rule_warning.sarif.json b/detekt-report-sarif/src/test/resources/rule_warning.sarif.json
index ecaa9e4f5298..d35bd1ed1b02 100644
--- a/detekt-report-sarif/src/test/resources/rule_warning.sarif.json
+++ b/detekt-report-sarif/src/test/resources/rule_warning.sarif.json
@@ -3,11 +3,6 @@
   "version": "2.1.0",
   "runs": [
     {
-      "originalUriBaseIds": {
-        "%SRCROOT%": {
-          "uri": "<BASE-PATH>"
-        }
-      },
       "results": [
         {
           "level": "error",
diff --git a/detekt-report-sarif/src/test/resources/vanilla.sarif.json b/detekt-report-sarif/src/test/resources/vanilla.sarif.json
index 39ab04d5d975..bc729c1f0c3a 100644
--- a/detekt-report-sarif/src/test/resources/vanilla.sarif.json
+++ b/detekt-report-sarif/src/test/resources/vanilla.sarif.json
@@ -3,11 +3,6 @@
   "version": "2.1.0",
   "runs": [
     {
-      "originalUriBaseIds": {
-        "%SRCROOT%": {
-          "uri": "<BASE-URL>"
-        }
-      },
       "results": [
         {
           "level": "error",