Repository: securego/gosec (Go)

Issue:
Sarif Output Results RuleIndex Mismatch
### Summary 
In the Sarif output, when you have multiple result types, the ruleIndex doesn't match the actual index of the rule in the rules array.

### Steps to reproduce the behavior
In the Sarif output in the next comment:
* runs[0].tool.driver.rules[7] is G302
* runs[0].tool.driver.rules[8] is G304
* runs[0].tool.driver.rules[10] is G306
* runs[0].tool.driver.rules[14] is G404

In the results:
* ruleId G304 references ruleIndex 7
* ruleId G306 references ruleIndex 14
And so on

### gosec version
2.15

### Go version (output of 'go version')
1.19

### Operating system / Environment
Linux/Github Action

### Expected behavior
The RuleIndex matches the index in the rules array of the proper rule. According to [Sarif spec](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317644) rule index is optional, so it could be omitted if it's not possible to make it match. 

### Actual behavior
It doesn't match



Discussion: ```json
{
	"runs": [
		{
			"results": [
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/rate_limiter/limiter.go"
								},
								"region": {
									"endColumn": 54,
									"endLine": 94,
									"sourceLanguage": "go",
									"startColumn": 54,
									"startLine": 94
								}
							}
						}
					],
					"message": {
						"text": "Use of weak random number generator (math/rand instead of crypto/rand)"
					},
					"ruleId": "G404"
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/conversations/importing/formats.go"
								},
								"region": {
									"endColumn": 52,
									"endLine": 31,
									"sourceLanguage": "go",
									"startColumn": 52,
									"startLine": 31
								}
							}
						}
					],
					"message": {
						"text": "Potential Integer overflow made by strconv.Atoi result conversion to int16/32"
					},
					"ruleId": "G109",
					"ruleIndex": 3
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/pipeline/runner/filetree/memblob/memblob.go"
								},
								"region": {
									"endColumn": 16,
									"endLine": 317,
									"sourceLanguage": "go",
									"startColumn": 16,
									"startLine": 317
								}
							}
						}
					],
					"message": {
						"text": "Use of weak cryptographic primitive"
					},
					"ruleId": "G401",
					"ruleIndex": 4
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "internal/metrics.go"
								},
								"region": {
									"endColumn": 8,
									"endLine": 106,
									"sourceLanguage": "go",
									"startColumn": 8,
									"startLine": 106
								}
							}
						}
					],
					"message": {
						"text": "Use of net/http serve function that has no support for setting timeouts"
					},
					"ruleId": "G114",
					"ruleIndex": 5
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/editor/editor.go"
								},
								"region": {
									"endColumn": 9,
									"endLine": 12,
									"sourceLanguage": "go",
									"startColumn": 9,
									"startLine": 12
								}
							}
						}
					],
					"message": {
						"text": "Subprocess launched with variable"
					},
					"ruleId": "G204",
					"ruleIndex": 6
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/zip/dir.go"
								},
								"region": {
									"endColumn": 16,
									"endLine": 78,
									"sourceLanguage": "go",
									"startColumn": 16,
									"startLine": 78
								}
							}
						}
					],
					"message": {
						"text": "Potential file inclusion via variable"
					},
					"ruleId": "G304",
					"ruleIndex": 7
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "internal/http.go"
								},
								"region": {
									"endColumn": 14,
									"endLine": 43,
									"sourceLanguage": "go",
									"startColumn": 14,
									"startLine": 37
								}
							}
						}
					],
					"message": {
						"text": "Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server"
					},
					"ruleId": "G112",
					"ruleIndex": 8
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/zip/dir.go"
								},
								"region": {
									"endColumn": 12,
									"endLine": 88,
									"sourceLanguage": "go",
									"startColumn": 12,
									"startLine": 88
								}
							}
						}
					],
					"message": {
						"text": "Potential DoS vulnerability via decompression bomb"
					},
					"ruleId": "G110",
					"ruleIndex": 9
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/length_delimited/merge/merge.go"
								},
								"region": {
									"endColumn": 56,
									"endLine": 185,
									"sourceLanguage": "go",
									"startColumn": 56,
									"startLine": 185
								}
							}
						}
					],
					"message": {
						"text": "Implicit memory aliasing in for loop."
					},
					"ruleId": "G601",
					"ruleIndex": 10
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/zip/dir.go"
								},
								"region": {
									"endColumn": 15,
									"endLine": 70,
									"sourceLanguage": "go",
									"startColumn": 15,
									"startLine": 70
								}
							}
						}
					],
					"message": {
						"text": "File traversal when extracting zip/tar archive"
					},
					"ruleId": "G305",
					"ruleIndex": 11
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/cli/zia/tree.go"
								},
								"region": {
									"endColumn": 18,
									"endLine": 217,
									"sourceLanguage": "go",
									"startColumn": 18,
									"startLine": 217
								}
							}
						}
					],
					"message": {
						"text": "Expect file permissions to be 0600 or less"
					},
					"ruleId": "G302",
					"ruleIndex": 12
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/zip/dir.go"
								},
								"region": {
									"endColumn": 10,
									"endLine": 73,
									"sourceLanguage": "go",
									"startColumn": 10,
									"startLine": 73
								}
							}
						}
					],
					"message": {
						"text": "Expect directory permissions to be 0750 or less"
					},
					"ruleId": "G301",
					"ruleIndex": 13
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/protobuf/file.go"
								},
								"region": {
									"endColumn": 8,
									"endLine": 29,
									"sourceLanguage": "go",
									"startColumn": 8,
									"startLine": 29
								}
							}
						}
					],
					"message": {
						"text": "Expect WriteFile permissions to be 0600 or less"
					},
					"ruleId": "G306",
					"ruleIndex": 14
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/playbooks/exported/playbook.go"
								},
								"region": {
									"endColumn": 9,
									"endLine": 156,
									"sourceLanguage": "go",
									"startColumn": 9,
									"startLine": 156
								}
							}
						}
					],
					"message": {
						"text": "Expect WriteFile permissions to be 0600 or less"
					},
					"ruleId": "G306",
					"ruleIndex": 14
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/utils/shard_writer/shard_writer.go"
								},
								"region": {
									"endColumn": 2,
									"endLine": 33,
									"sourceLanguage": "go",
									"startColumn": 2,
									"startLine": 33
								}
							}
						}
					],
					"message": {
						"text": "Deferring unsafe method \"Close\" on type \"io.WriteCloser\""
					},
					"ruleId": "G307",
					"ruleIndex": 15
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/nlp/hash.go"
								},
								"region": {
									"endColumn": 2,
									"endLine": 4,
									"sourceLanguage": "go",
									"startColumn": 2,
									"startLine": 4
								}
							}
						}
					],
					"message": {
						"text": "Blocklisted import crypto/sha1: weak cryptographic primitive"
					},
					"ruleId": "G505",
					"ruleIndex": 16
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "pkg/pipeline/runner/filetree/memblob/memblob.go"
								},
								"region": {
									"endColumn": 2,
									"endLine": 33,
									"sourceLanguage": "go",
									"startColumn": 2,
									"startLine": 33
								}
							}
						}
					],
					"message": {
						"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
					},
					"ruleId": "G501",
					"ruleIndex": 17
				}
			],
			"taxonomies": [
				{
					"downloadUri": "https://cwe.mitre.org/data/xml/cwec_v4.4.xml.zip",
					"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
					"informationUri": "https://cwe.mitre.org/data/published/cwe_v4.4.pdf/",
					"isComprehensive": true,
					"language": "en",
					"minimumRequiredLocalizedDataSemanticVersion": "4.4",
					"name": "CWE",
					"organization": "MITRE",
					"releaseDateUtc": "2021-03-15",
					"shortDescription": {
						"text": "The MITRE Common Weakness Enumeration"
					},
					"taxa": [
						{
							"fullDescription": {
								"text": "The software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files."
							},
							"guid": "ebb90d25-d5f3-32f8-b42a-b74b23984fbb",
							"helpUri": "https://cwe.mitre.org/data/definitions/118.html",
							"id": "118",
							"shortDescription": {
								"text": "Incorrect Access of Indexable Resource ('Range Error')"
							}
						},
						{
							"fullDescription": {
								"text": "The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control."
							},
							"guid": "c71e4fa0-720e-3e82-8b67-b2d44d0c604b",
							"helpUri": "https://cwe.mitre.org/data/definitions/190.html",
							"id": "190",
							"shortDescription": {
								"text": "Integer Overflow or Wraparound"
							}
						},
						{
							"fullDescription": {
								"text": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."
							},
							"guid": "89ce426b-e6d8-38b2-ac7f-8ad85b74d551",
							"helpUri": "https://cwe.mitre.org/data/definitions/200.html",
							"id": "200",
							"shortDescription": {
								"text": "Exposure of Sensitive Information to an Unauthorized Actor"
							}
						},
						{
							"fullDescription": {
								"text": "The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
							},
							"guid": "3e718404-88bc-3f17-883e-e85e74078a76",
							"helpUri": "https://cwe.mitre.org/data/definitions/22.html",
							"id": "22",
							"shortDescription": {
								"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
							}
						},
						{
							"fullDescription": {
								"text": "During installation, installed file permissions are set to allow anyone to modify those files."
							},
							"guid": "fca8970d-b44c-3162-a385-cc09266d12a4",
							"helpUri": "https://cwe.mitre.org/data/definitions/276.html",
							"id": "276",
							"shortDescription": {
								"text": "Incorrect Default Permissions"
							}
						},
						{
							"fullDescription": {
								"text": "The software does not validate, or incorrectly validates, a certificate."
							},
							"guid": "09e885ea-951b-3143-801a-241b3aa9e6c9",
							"helpUri": "https://cwe.mitre.org/data/definitions/295.html",
							"id": "295",
							"shortDescription": {
								"text": "Improper Certificate Validation"
							}
						},
						{
							"fullDescription": {
								"text": "The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required."
							},
							"guid": "fe6ccccf-c3a1-354b-b67c-6c76007360e6",
							"helpUri": "https://cwe.mitre.org/data/definitions/326.html",
							"id": "326",
							"shortDescription": {
								"text": "Inadequate Encryption Strength"
							}
						},
						{
							"fullDescription": {
								"text": "The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information."
							},
							"guid": "3d8ac75a-952a-30cd-ab4f-911c879d8d2b",
							"helpUri": "https://cwe.mitre.org/data/definitions/327.html",
							"id": "327",
							"shortDescription": {
								"text": "Use of a Broken or Risky Cryptographic Algorithm"
							}
						},
						{
							"fullDescription": {
								"text": "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong."
							},
							"guid": "0512047f-75a2-3ac3-bb28-97df3a80efbe",
							"helpUri": "https://cwe.mitre.org/data/definitions/338.html",
							"id": "338",
							"shortDescription": {
								"text": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
							}
						},
						{
							"fullDescription": {
								"text": "The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources."
							},
							"guid": "5d980950-93cd-3caf-9057-858ec3c28877",
							"helpUri": "https://cwe.mitre.org/data/definitions/400.html",
							"id": "400",
							"shortDescription": {
								"text": "Uncontrolled Resource Consumption"
							}
						},
						{
							"fullDescription": {
								"text": "The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output."
							},
							"guid": "8f97f42f-c62a-3d38-b26d-97951029c895",
							"helpUri": "https://cwe.mitre.org/data/definitions/409.html",
							"id": "409",
							"shortDescription": {
								"text": "Improper Handling of Highly Compressed Data (Data Amplification)"
							}
						},
						{
							"fullDescription": {
								"text": "The program invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely."
							},
							"guid": "f97fef5f-b85b-3d63-9932-7053f298803d",
							"helpUri": "https://cwe.mitre.org/data/definitions/676.html",
							"id": "676",
							"shortDescription": {
								"text": "Use of Potentially Dangerous Function"
							}
						},
						{
							"fullDescription": {
								"text": "The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software."
							},
							"guid": "7df38d1d-038e-3ced-8601-8d9265b90a25",
							"helpUri": "https://cwe.mitre.org/data/definitions/703.html",
							"id": "703",
							"shortDescription": {
								"text": "Improper Check or Handling of Exceptional Conditions"
							}
						},
						{
							"fullDescription": {
								"text": "The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."
							},
							"guid": "1a37bf66-7c5a-3aa0-94bb-ffae58a9e01c",
							"helpUri": "https://cwe.mitre.org/data/definitions/78.html",
							"id": "78",
							"shortDescription": {
								"text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
							}
						}
					],
					"version": "4.4"
				}
			],
			"tool": {
				"driver": {
					"guid": "8b518d5f-906d-39f9-894b-d327b1a421c5",
					"informationUri": "https://github.com/securego/gosec/",
					"name": "gosec",
					"rules": [
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Profiling endpoint is automatically exposed on /debug/pprof"
							},
							"help": {
								"text": "Profiling endpoint is automatically exposed on /debug/pprof\nSeverity: HIGH\nConfidence: HIGH\n"
							},
							"id": "G108",
							"name": "Exposure of Sensitive Information to an Unauthorized Actor",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"HIGH"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "89ce426b-e6d8-38b2-ac7f-8ad85b74d551",
										"id": "200",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Profiling endpoint is automatically exposed on /debug/pprof"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Potential Integer overflow made by strconv.Atoi result conversion to int16/32"
							},
							"help": {
								"text": "Potential Integer overflow made by strconv.Atoi result conversion to int16/32\nSeverity: HIGH\nConfidence: MEDIUM\n"
							},
							"id": "G109",
							"name": "Integer Overflow or Wraparound",
							"properties": {
								"precision": "medium",
								"tags": [
									"security",
									"HIGH"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "c71e4fa0-720e-3e82-8b67-b2d44d0c604b",
										"id": "190",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Potential Integer overflow made by strconv.Atoi result conversion to int16/32"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Potential DoS vulnerability via decompression bomb"
							},
							"help": {
								"text": "Potential DoS vulnerability via decompression bomb\nSeverity: MEDIUM\nConfidence: MEDIUM\n"
							},
							"id": "G110",
							"name": "Improper Handling of Highly Compressed Data (Data Amplification)",
							"properties": {
								"precision": "medium",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "8f97f42f-c62a-3d38-b26d-97951029c895",
										"id": "409",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Potential DoS vulnerability via decompression bomb"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server"
							},
							"help": {
								"text": "Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server\nSeverity: MEDIUM\nConfidence: LOW\n"
							},
							"id": "G112",
							"name": "Uncontrolled Resource Consumption",
							"properties": {
								"precision": "low",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "5d980950-93cd-3caf-9057-858ec3c28877",
										"id": "400",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Use of net/http serve function that has no support for setting timeouts"
							},
							"help": {
								"text": "Use of net/http serve function that has no support for setting timeouts\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G114",
							"name": "Use of Potentially Dangerous Function",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "f97fef5f-b85b-3d63-9932-7053f298803d",
										"id": "676",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Use of net/http serve function that has no support for setting timeouts"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Subprocess launched with variable"
							},
							"help": {
								"text": "Subprocess launched with variable\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G204",
							"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "1a37bf66-7c5a-3aa0-94bb-ffae58a9e01c",
										"id": "78",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Subprocess launched with variable"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Expect directory permissions to be 0750 or less"
							},
							"help": {
								"text": "Expect directory permissions to be 0750 or less\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G301",
							"name": "Incorrect Default Permissions",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "fca8970d-b44c-3162-a385-cc09266d12a4",
										"id": "276",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Expect directory permissions to be 0750 or less"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Expect file permissions to be 0600 or less"
							},
							"help": {
								"text": "Expect file permissions to be 0600 or less\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G302",
							"name": "Incorrect Default Permissions",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "fca8970d-b44c-3162-a385-cc09266d12a4",
										"id": "276",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Expect file permissions to be 0600 or less"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Potential file inclusion via variable"
							},
							"help": {
								"text": "Potential file inclusion via variable\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G304",
							"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "3e718404-88bc-3f17-883e-e85e74078a76",
										"id": "22",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Potential file inclusion via variable"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "File traversal when extracting zip/tar archive"
							},
							"help": {
								"text": "File traversal when extracting zip/tar archive\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G305",
							"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "3e718404-88bc-3f17-883e-e85e74078a76",
										"id": "22",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "File traversal when extracting zip/tar archive"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Expect WriteFile permissions to be 0600 or less"
							},
							"help": {
								"text": "Expect WriteFile permissions to be 0600 or less\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G306",
							"name": "Incorrect Default Permissions",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "fca8970d-b44c-3162-a385-cc09266d12a4",
										"id": "276",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Expect WriteFile permissions to be 0600 or less"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Deferring unsafe method \"Close\" on type \"io.WriteCloser\""
							},
							"help": {
								"text": "Deferring unsafe method \"Close\" on type \"io.WriteCloser\"\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G307",
							"name": "Improper Check or Handling of Exceptional Conditions",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "7df38d1d-038e-3ced-8601-8d9265b90a25",
										"id": "703",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Deferring unsafe method \"Close\" on type \"io.WriteCloser\""
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Use of weak cryptographic primitive"
							},
							"help": {
								"text": "Use of weak cryptographic primitive\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G401",
							"name": "Inadequate Encryption Strength",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "fe6ccccf-c3a1-354b-b67c-6c76007360e6",
										"id": "326",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Use of weak cryptographic primitive"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "TLS MinVersion too low."
							},
							"help": {
								"text": "TLS MinVersion too low.\nSeverity: HIGH\nConfidence: HIGH\n"
							},
							"id": "G402",
							"name": "Improper Certificate Validation",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"HIGH"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "09e885ea-951b-3143-801a-241b3aa9e6c9",
										"id": "295",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "TLS MinVersion too low."
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Use of weak random number generator (math/rand instead of crypto/rand)"
							},
							"help": {
								"text": "Use of weak random number generator (math/rand instead of crypto/rand)\nSeverity: HIGH\nConfidence: MEDIUM\n"
							},
							"id": "G404",
							"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
							"properties": {
								"precision": "medium",
								"tags": [
									"security",
									"HIGH"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "0512047f-75a2-3ac3-bb28-97df3a80efbe",
										"id": "338",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Use of weak random number generator (math/rand instead of crypto/rand)"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
							},
							"help": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G501",
							"name": "Use of a Broken or Risky Cryptographic Algorithm",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "3d8ac75a-952a-30cd-ab4f-911c879d8d2b",
										"id": "327",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Blocklisted import crypto/md5: weak cryptographic primitive"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Blocklisted import crypto/sha1: weak cryptographic primitive"
							},
							"help": {
								"text": "Blocklisted import crypto/sha1: weak cryptographic primitive\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G505",
							"name": "Use of a Broken or Risky Cryptographic Algorithm",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "3d8ac75a-952a-30cd-ab4f-911c879d8d2b",
										"id": "327",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Blocklisted import crypto/sha1: weak cryptographic primitive"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Implicit memory aliasing in for loop."
							},
							"help": {
								"text": "Implicit memory aliasing in for loop.\nSeverity: MEDIUM\nConfidence: MEDIUM\n"
							},
							"id": "G601",
							"name": "Incorrect Access of Indexable Resource ('Range Error')",
							"properties": {
								"precision": "medium",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "ebb90d25-d5f3-32f8-b42a-b74b23984fbb",
										"id": "118",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Implicit memory aliasing in for loop."
							}
						}
					],
					"semanticVersion": "2.15.0",
					"supportedTaxonomies": [
						{
							"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
							"name": "CWE"
						}
					],
					"version": "2.15.0"
				}
			}
		}
	],
	"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
	"version": "2.1.0"
}

```



Fix (patch):
diff --git a/report/sarif/formatter.go b/report/sarif/formatter.go
index 5c029ccd2e..65646f356e 100644
--- a/report/sarif/formatter.go
+++ b/report/sarif/formatter.go
@@ -12,20 +12,13 @@ import (
 	"github.com/securego/gosec/v2/issue"
 )
 
-// GenerateReport Convert a gosec report to a Sarif Report
+// GenerateReport converts a gosec report into a SARIF report
 func GenerateReport(rootPaths []string, data *gosec.ReportInfo) (*Report, error) {
-	type rule struct {
-		index int
-		rule  *ReportingDescriptor
-	}
-
-	rules := make([]*ReportingDescriptor, 0)
-	rulesIndices := make(map[string]rule)
-	lastRuleIndex := -1
+	rules := []*ReportingDescriptor{}
 
 	results := []*Result{}
-	cweTaxa := make([]*ReportingDescriptor, 0)
-	weaknesses := make(map[string]*cwe.Weakness)
+	cweTaxa := []*ReportingDescriptor{}
+	weaknesses := map[string]*cwe.Weakness{}
 
 	for _, issue := range data.Issues {
 		if issue.Cwe != nil {
@@ -38,26 +31,26 @@ func GenerateReport(rootPaths []string, data *gosec.ReportInfo) (*Report, error)
 			}
 		}
 
-		r, ok := rulesIndices[issue.RuleID]
-		if !ok {
-			lastRuleIndex++
-			r = rule{index: lastRuleIndex, rule: parseSarifRule(issue)}
-			rulesIndices[issue.RuleID] = r
-			rules = append(rules, r.rule)
-		}
+		rule := parseSarifRule(issue)
+		ruleIndex := 0
+		rules, ruleIndex = addRuleInOrder(rules, rule)
 
 		location, err := parseSarifLocation(issue, rootPaths)
 		if err != nil {
 			return nil, err
 		}
 
-		result := NewResult(r.rule.ID, r.index, getSarifLevel(issue.Severity.String()), issue.What, buildSarifSuppressions(issue.Suppressions)).
-			WithLocations(location)
+		result := NewResult(
+			issue.RuleID,
+			ruleIndex,
+			getSarifLevel(issue.Severity.String()),
+			issue.What,
+			buildSarifSuppressions(issue.Suppressions),
+		).WithLocations(location)
 
 		results = append(results, result)
 	}
 
-	sort.SliceStable(rules, func(i, j int) bool { return rules[i].ID < rules[j].ID })
 	sort.SliceStable(cweTaxa, func(i, j int) bool { return cweTaxa[i].ID < cweTaxa[j].ID })
 
 	tool := NewTool(buildSarifDriver(rules, data.GosecVersion))
@@ -72,6 +65,26 @@ func GenerateReport(rootPaths []string, data *gosec.ReportInfo) (*Report, error)
 		WithRuns(run), nil
 }
 
+// addRuleInOrder inserts a rule into the rules slice keeping the rules IDs order, it returns the new rules
+// slice and the position where the rule was inserted
+func addRuleInOrder(rules []*ReportingDescriptor, rule *ReportingDescriptor) ([]*ReportingDescriptor, int) {
+	position := 0
+	for i, r := range rules {
+		if r.ID < rule.ID {
+			continue
+		}
+		if r.ID == rule.ID {
+			return rules, i
+		}
+		position = i
+		break
+	}
+	rules = append(rules, nil)
+	copy(rules[position+1:], rules[position:])
+	rules[position] = rule
+	return rules, position
+}
+
 // parseSarifRule return SARIF rule field struct
 func parseSarifRule(i *issue.Issue) *ReportingDescriptor {
 	cwe := issue.GetCweByRule(i.RuleID)