Enrich diff markdown and SARIF outputs

Author: bomly-guy

.github/workflows/bomly-review.yml

@@ -7,6 +7,7 @@ permissions:
   contents: read
   pull-requests: write
   issues: write
+  security-events: write
 
 jobs:
   review:

docs/OUTPUT_FORMATS.md

@@ -78,12 +78,14 @@ bomly scan --enrich --audit --fail-on high --format sarif > bomly.sarif
 
 GitHub Code Scanning, Azure DevOps, and most IDE extensions ingest SARIF directly. See [CI integration](CI_INTEGRATION.md) for upload recipes.
 
-## SBOM output: `-o`
+## Additional output: `-o`
 
-Independent of `--format`. You can write any number of SBOM artifacts alongside the reporting output:
+Independent of `--format`. You can write review reports and SBOM artifacts alongside the primary output:
 
 ```bash
 bomly scan --format json \
+  -o markdown=summary.md \
+  -o sarif=bomly.sarif \
   -o spdx=sbom.spdx.json \
   -o cyclonedx=sbom.cdx.json
 ```
@@ -92,10 +94,12 @@ Supported targets:
 
 | `-o` value | Format |
 | --- | --- |
+| `markdown` | GitHub-flavored Markdown report |
+| `sarif` | SARIF 2.1.0 report; requires `--audit` |
 | `spdx` | SPDX 2.3 JSON |
 | `cyclonedx` | CycloneDX 1.6 JSON |
 
-See [SBOM formats](SBOM.md) for the comparison and writing rules.
+`spdx` and `cyclonedx` are supported by `scan`. `markdown` and `sarif` are supported by report-producing commands. See [SBOM formats](SBOM.md) for the SBOM comparison and writing rules.
 
 ## Combining outputs
 
@@ -110,10 +114,12 @@ Example:
 
 ```bash
 bomly scan --enrich --audit --fail-on high \
-  --format sarif \
+  --format json \
+  -o markdown=summary.md \
+  -o sarif=bomly.sarif \
   -o spdx=sbom.spdx.json \
   -o cyclonedx=sbom.cdx.json \
-  > bomly.sarif
+  > bomly.json
 ```
 
 Detector and matcher work runs once. All outputs derive from the same in-memory graph.

internal/cli/diff_cmd.go

@@ -87,9 +87,12 @@ func newDiffCmd() *cobra.Command {
 			if err != nil {
 				return exit.InvalidInputError("%v", err)
 			}
-			if err := validateMarkdownOnlyOutputs(outputSpecs); err != nil {
+			if err := validateReportOutputs(outputSpecs); err != nil {
 				return exit.InvalidInputError("%v", err)
 			}
+			if hasOutputFormat(outputSpecs, render.OutputFormatSARIF) && !current.Audit {
+				return exit.InvalidInputError("-o sarif requires --audit")
+			}
 			if current.Interactive && len(outputSpecs) > 0 {
 				return exit.InvalidInputError("--output cannot be combined with --interactive")
 			}
@@ -159,11 +162,23 @@ func newDiffCmd() *cobra.Command {
 			markdownRenderer := func(w io.Writer) error {
 				return render.DiffMarkdown(w, payload)
 			}
+			sarifRenderer := func(w io.Writer) error {
+				return output.WriteSARIF(w, diffResult.Findings, "bomly", cmd.Root().Version)
+			}
 			if len(outputSpecs) > 0 {
 				prog.Advance("Writing additional output")
 				for _, spec := range outputSpecs {
-					if err := writeRenderedOutput(streams.reportWriter(), spec, markdownRenderer); err != nil {
-						return err
+					switch spec.Format {
+					case render.OutputFormatMarkdown:
+						if err := writeRenderedOutput(streams.reportWriter(), spec, markdownRenderer); err != nil {
+							return err
+						}
+					case render.OutputFormatSARIF:
+						if err := writeRenderedOutput(streams.reportWriter(), spec, sarifRenderer); err != nil {
+							return err
+						}
+					default:
+						return exit.InvalidInputError("output format %q is only supported by scan", spec.Label)
 					}
 				}
 			}

internal/cli/diff_cmd_test.go

@@ -52,6 +52,18 @@ func TestRenderDiffMarkdownIncludesPatchedVersionsByDefault(t *testing.T) {
 				Added:   []output.DiffPackageChange{{Package: output.PackageRef{Name: "react", Version: "18.2.0"}}},
 				Changed: []output.DiffChangedPackage{{After: output.PackageRef{Name: "zod", Version: "3.23.0"}, Before: output.PackageRef{Name: "zod", Version: "3.22.0"}}},
 			},
+			Vulnerabilities: output.DiffVulnerabilityResults{
+				Added: []output.DiffVulnerabilityChange{{
+					Package: output.PackageRef{Name: "react", Version: "18.2.0"},
+					Vulnerability: output.VulnerabilityRef{
+						ID:       "OSV-123",
+						Severity: "high",
+						Source:   "osv",
+						Title:    "Prototype pollution in react",
+						FixedIn:  "18.2.1",
+					},
+				}},
+			},
 		},
 		Audit: &output.DiffAudit{
 			Introduced: []output.AuditFinding{{
@@ -75,10 +87,13 @@ func TestRenderDiffMarkdownIncludesPatchedVersionsByDefault(t *testing.T) {
 	for _, want := range []string{
 		"# Bomly Diff Summary",
 		"Compared `main` to `feature`.",
-		"- Added: 1",
-		"- Changed: 1",
+		"**Summary:** 1 added, 1 changed, 0 removed.",
+		"| added | react@18.2.0 | 18.2.0 | unknown | - | - |",
+		"| changed | zod | 3.22.0 → 3.23.0 | unknown | - | - |",
 		"## Vulnerabilities",
-		"- [fail] `react@18.2.0`: Prototype pollution in react (patched in `18.2.1`)",
+		"| ❌ | introduced | HIGH | OSV-123 | react@18.2.0 | 18.2.1 | osv | Prototype pollution in react |",
+		"## Policy Findings",
+		"| ❌ | introduced | vulnerability | HIGH | fail | OSV-123 | react@18.2.0 | 18.2.1 | Prototype pollution in react |",
 	} {
 		if !strings.Contains(report, want) {
 			t.Fatalf("expected Markdown report to contain %q, got:\n%s", want, report)

internal/cli/explain_cmd.go

@@ -59,9 +59,12 @@ func newExplainCmd() *cobra.Command {
 			if err != nil {
 				return exit.InvalidInputError("%v", err)
 			}
-			if err := validateMarkdownOnlyOutputs(outputSpecs); err != nil {
+			if err := validateReportOutputs(outputSpecs); err != nil {
 				return exit.InvalidInputError("%v", err)
 			}
+			if hasOutputFormat(outputSpecs, render.OutputFormatSARIF) && !context.ResolvedConfig.Audit {
+				return exit.InvalidInputError("-o sarif requires --audit")
+			}
 			if context.ResolvedConfig.Interactive && len(outputSpecs) > 0 {
 				return exit.InvalidInputError("--output cannot be combined with --interactive")
 			}
@@ -112,8 +115,19 @@ func newExplainCmd() *cobra.Command {
 			if len(outputSpecs) > 0 {
 				prog.Advance("Writing additional output")
 				for _, spec := range outputSpecs {
-					if err := writeRenderedOutput(streams.reportWriter(), spec, markdownRenderer); err != nil {
-						return err
+					switch spec.Format {
+					case render.OutputFormatMarkdown:
+						if err := writeRenderedOutput(streams.reportWriter(), spec, markdownRenderer); err != nil {
+							return err
+						}
+					case render.OutputFormatSARIF:
+						if err := writeRenderedOutput(streams.reportWriter(), spec, func(w io.Writer) error {
+							return output.WriteSARIF(w, explainResult.Findings, "bomly", cmd.Root().Version)
+						}); err != nil {
+							return err
+						}
+					default:
+						return exit.InvalidInputError("output format %q is only supported by scan", spec.Label)
 					}
 				}
 			}

internal/cli/output_artifacts.go

@@ -24,6 +24,15 @@ func hasStdoutOutput(specs []render.OutputSpec) bool {
 	return false
 }
 
+func hasOutputFormat(specs []render.OutputSpec, format render.OutputFormat) bool {
+	for _, spec := range specs {
+		if spec.Format == format {
+			return true
+		}
+	}
+	return false
+}
+
 func allOutputsAreSBOM(specs []render.OutputSpec) bool {
 	if len(specs) == 0 {
 		return false
@@ -45,6 +54,17 @@ func validateMarkdownOnlyOutputs(specs []render.OutputSpec) error {
 	return nil
 }
 
+func validateReportOutputs(specs []render.OutputSpec) error {
+	for _, spec := range specs {
+		switch spec.Format {
+		case render.OutputFormatMarkdown, render.OutputFormatSARIF:
+		default:
+			return fmt.Errorf("output format %q is only supported by scan", spec.Label)
+		}
+	}
+	return nil
+}
+
 func writeRenderedOutput(stdout io.Writer, spec render.OutputSpec, renderer func(io.Writer) error) error {
 	var buf bytes.Buffer
 	if err := renderer(&buf); err != nil {