fix(output): handle findings object + locations/rules in SARIF, wire into ci

[tim-thacker-nullify]

Why

The SARIF formatter (internal/output/sarif.go) only accepted a top-level JSON array or a {type,data} wrapper, so nullify findings -o sarif failed — the findings command emits {"findings":[...],"total":N}. The output also emitted only ruleId/level/message, with no locations[] (consumers couldn't place findings) and no rules[] driver section (so ruleId references dangled).

The ci command also didn't expose SARIF at all, ci gate reported truncated counts (it queried with limit=1 then counted the items array), and it only failed when all scanner requests errored — silently passing if some scanners failed.

What

internal/output/sarif.go

• Unwrap the {findings,total} object shape, in addition to the existing top-level array and {type,data} wrapper.
• Emit a locations[] entry per finding from common location keys: filePath/file/path + startLine/line/lineNumber for code, and uri/url for DAST.
• Emit a distinct rules[] array under tool.driver.rules from the rule IDs seen, so references resolve.
• Severity → level mapping preserved (critical/high → error, medium → warning, low/info → note, unknown → warning). Defensive against missing fields (no panics).
• Exposed SARIFBytes() for reuse by ci report.

cmd/cli/cmd/root.go

• --output/-o usage string now lists sarif.

cmd/cli/cmd/ci.go

• ci report gains a --format flag: markdown (default) or sarif.
• ci gate counts via the response total field instead of the limit-truncated items array, for accurate counts.
• ci gate is now fail-closed: any scanner request error fails the gate (non-zero exit) instead of only failing when every request errors.

Tests

• Table-driven SARIF tests covering the {findings,total} object, locations, rules, dedup, DAST url locations, wrapped per-type results, and missing-field defensiveness. Existing tests still pass.

Verification

• GOWORK=off CGO_ENABLED=0 go build ./...
• GOWORK=off go vet ./...
• GOWORK=off go test ./...
• golangci-lint run (0 issues)

🤖 Generated with Claude Code

[tim-thacker-nullify]

Status check (2026-05-28): still relevant. Verified on main:

• internal/output/sarif.go (134 lines) still only accepts a top-level array or {type,data} wrapper — findings -o sarif against the unified {findings,total} shape still breaks.
• No locations[] emitted, no rules[] driver section.
• ci report has no --format flag (Short: "Generate a markdown summary for PR comments"); ci gate still counts the truncated items array.

Nothing on main supersedes any of it. Recommend rebase + un-draft.