Point at the SARIF report instead of "No output available" in reporters - #8781
Merged
Conversation
A linter reporting in SARIF writes nothing to stdout, so its details
section in every reporter was a dead end saying "No output available".
It now names the SARIF report to open and links the artifacts.
- One helper in utils_reporter._build_missing_output_message, used by both
dead ends ("No output available" and "Linter output file not found"), so
the GitHub, GitLab, Azure and Bitbucket comment reporters and the
markdown summary all benefit
- The link reuses action_run_url, which the summary footer already renders
as "See detailed reports in MegaLinter artifacts", so it inherits the
REPORTERS_ACTION_RUN_URL override and is already the published artifacts
view on Azure. Without it, the message degrades to naming the file only
- The hint keys on the linter SARIF intent rather than on the file being
present: SarifReporter runs first (processing_order -9999) and removes
the per-linter SARIF files when LOG_FILE is "none", so a filesystem
check would have hidden the message in that configuration
- The report is named relative to the report folder (sarif/LINTER.sarif),
never as the absolute container path
Closes #8730
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 22, 2026 23:15
Member
Author
|
@bdovaz does it seem ok for you to fix the issue you declared ? :) |
Contributor
✅
|
Collaborator
|
I think that's a great solution! thanks! |
Member
Author
|
@bdovaz thanks for your feedback, merged ;) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #8730.
Problem
A linter reporting in SARIF writes nothing to stdout, so its per-linter details section in every reporter was a dead end:
Fix
The details section now names the SARIF report to open and links the artifacts:
No text output: ruff reports in SARIF format. Download [MegaLinter artifacts](…) and opensarif/PYTHON_RUFF.sarif``No text output: ruff reports in SARIF format. Seesarif/PYTHON_RUFF.sarifin MegaLinter artifactsOne helper in
utils_reporter, used by both dead ends —No output availableandLinter output file not found— so the GitHub, GitLab, Azure and Bitbucket comment reporters and the markdown summary all benefit from a single change, as @bdovaz expected in the issue.Three refinements on the issue's proposal
The issue suggested
f"Download the artifact named {linter.sarif_output_file}"guarded byos.path.isfile(...). Three things came out of checking that against the code:1.
sarif_output_fileis not an artifact name. It is built atLinter.py:1959as{report_folder}/sarif/{LINTER_NAME}.sarif— an absolute container path like/tmp/lint/megalinter-reports/sarif/PYTHON_RUFF.sarif. The artifact is named in the user's ownupload-artifactstep (MegaLinter reportsin the shipped workflow), so MegaLinter cannot know it. The message names the path relative to the report folder instead, and a test asserts the absolute path never leaks into it.2.
os.path.isfile()would have been flaky.SarifReporter.processing_order = -9999— it runs before the comment reporters, and atSarifReporter.py:94it deletes each per-linter.sarifwhenLOG_FILE: none. A stat at comment-build time would beFalsein exactly that configuration and the hint would silently vanish. The condition is the linter's SARIF intent (can_output_sarif+output_sarif+sarif_output_file is not None) instead.3.
Linter output file not foundis the sibling dead end. It fires whenTEXT_REPORTERis off or report files cannot be written; a SARIF linter reaches it too, and the same guidance applies.On the artifacts link
No new URL is invented.
build_markdown_summary_footeralready renders this exact value as "See detailed reports in MegaLinter artifacts", andaction_run_urlwas already a parameter of_build_sections_content— so there is no signature change and the link inherits whatever correctness the footer already has, including theREPORTERS_ACTION_RUN_URLoverride.On Azure it is already a true deep link: the reporter passes
get_artifacts_url()(the published-artifacts view) by default.I deliberately did not build platform-specific artifact routes such as
{CI_JOB_URL}/artifacts/browseor a GitHub#artifactsanchor: whether artifacts exist at all depends on the user's own CI config, so those would 404 for anyone without an upload step. When no URL is available (the markdown summary passes""), the message degrades to naming the file, mirroring the footer's own fallback.Testing
9 new cases in
utils_reporter_test.py(25 pass in the file), covering: the linked and unlinked renderings, both dead-end branches, non-SARIF linters staying byte-identical, SARIF-capable-but-disabled, SARIF-enabled-without-output-file, and no absolute path leaking.One robustness fix found while testing rather than assumed:
report_foldercan legitimately be""(Linter.py:346-347), andos.path.relpathagainst it produced../../tmp/lint/…. The path is now derived the same wayget_sarif_arguments()builds it, which cannot walk out of the report folder — with a regression test.No descriptor touched, so no
make megalinter-build.