Module sarif 

SARIF v2.1.0 formatter for audit reports (issue #562).

SARIF (Static Analysis Results Interchange Format) is the OASIS-standard schema for static-analysis findings. It is the native ingestion format for GitHub Advanced Security (Code Scanning), GitLab Ultra, Sonatype Lifecycle, and most other enterprise security platforms.

The emitter maps ssg audit’s domain model 1:1 to SARIF:

ssg field	SARIF field
crate::audit::AuditReport	runs[0]
crate::audit::GateResult	runs[0].tool.driver.rules[] (one per gate)
crate::audit::Finding	runs[0].results[]
crate::audit::Finding::gate	result.ruleId (or <gate>.<code> when code present)
crate::audit::Severity	result.level (error / warning / note)
crate::audit::Finding::path	result.locations[0].physicalLocation.artifactLocation.uri
crate::audit::Finding::message	result.message.text

Site-wide findings (no path) omit the locations array per the SARIF spec.

Acceptance criteria (issue #562)

1. ssg audit --format=sarif > out.sarif produces a file that passes the SARIF v2.1.0 validator.
2. New CI step uploads the SARIF artefact via github/codeql-action/upload-sarif@v3.
3. Findings appear in the GitHub Security tab on a deliberately- broken fixture.

Functions

format

Serialises report to a pretty-printed SARIF v2.1.0 JSON string.