Severity
P2 (medium). Pure upside, lives entirely in the action — no scanner change required. Improves the "red gate, now what?" experience.
Context
When the scanner detects an infection it can't auto-fix (stayAwakeBot #1183/#1184/#1185), the job goes red and the operator digs through raw logs. The action already has the machine-readable report — it can put findings where a reviewer will see them.
Proposed (action-layer only)
- SARIF upload.
saw scan --sarif <file> already emits SARIF 2.1.0; add an optional step to upload via github/codeql-action/upload-sarif → Security tab + inline annotation on the exact line (e.g. postcss.config.mjs:11).
- Artifacts. Upload the JSON report and any
sab-patches/*.patch via actions/upload-artifact so evidence travels with the run.
- Actionable step summary. On infected/aborted, write the per-finding manual-review guidance (reason + command from stayAwakeBot #1184) to
$GITHUB_STEP_SUMMARY, optionally a sticky PR comment.
Scope — general
Applies to any infected or aborted run, any finding category — not the motivating payload specifically.
Safety / correctness invariants (must NOT introduce mistakes)
- Additive only. These steps must never change the gate outcome — the verdict is decided before and independently of them.
- Least privilege. SARIF upload needs
security-events: write; scope that to the upload step, keep the scan job contents: read, and don't blanket-grant. Document the minimum, don't recommend flipping the repo default token to read/write.
- Redact + escape. The summary/PR-comment path must reuse the scanner's evidence redaction and escape untrusted paths so a crafted filename can't inject markdown or
::-workflow commands into the summary (mirrors stayAwakeBot #1184). --sarif and -d reports are already redacted — keep it; never upload the raw infected file as an artifact (redacted report + fix patches only).
- Capability-probe. A missing
--sarif/-d on an old pinned version must skip, not fail — consistent with the action's existing probing.
- Fork PRs degrade, don't fail. From a fork the token can't upload SARIF or comment; fall back to artifact-only and never fail the job for lack of permission.
Non-goal
Visibility only; does not touch gate semantics. Complements stayAwakeBot #1183/#1184.
Severity
P2 (medium). Pure upside, lives entirely in the action — no scanner change required. Improves the "red gate, now what?" experience.
Context
When the scanner detects an infection it can't auto-fix (stayAwakeBot #1183/#1184/#1185), the job goes red and the operator digs through raw logs. The action already has the machine-readable report — it can put findings where a reviewer will see them.
Proposed (action-layer only)
saw scan --sarif <file>already emits SARIF 2.1.0; add an optional step to upload viagithub/codeql-action/upload-sarif→ Security tab + inline annotation on the exact line (e.g.postcss.config.mjs:11).sab-patches/*.patchviaactions/upload-artifactso evidence travels with the run.$GITHUB_STEP_SUMMARY, optionally a sticky PR comment.Scope — general
Applies to any infected or aborted run, any finding category — not the motivating payload specifically.
Safety / correctness invariants (must NOT introduce mistakes)
security-events: write; scope that to the upload step, keep the scan jobcontents: read, and don't blanket-grant. Document the minimum, don't recommend flipping the repo default token to read/write.::-workflow commands into the summary (mirrors stayAwakeBot #1184).--sarifand-dreports are already redacted — keep it; never upload the raw infected file as an artifact (redacted report + fix patches only).--sarif/-don an old pinnedversionmust skip, not fail — consistent with the action's existing probing.Non-goal
Visibility only; does not touch gate semantics. Complements stayAwakeBot #1183/#1184.