@@ -68,6 +68,53 @@ describe("run-opengrep.sh", () => {
6868expect(args).toContain("security/opengrep/precise.yml");
6969});
707071+it("writes empty SARIF when a changed scan has no first-party paths", () => {
72+const repo = createTempDir("openclaw-run-opengrep-empty-sarif-");
73+git(repo, "init", "-q");
74+git(repo, "config", "user.email", "test@example.com");
75+git(repo, "config", "user.name", "Test User");
76+77+copyRunOpengrepFiles(repo);
78+writeFile(path.join(repo, "security/opengrep/precise.yml"), "rules: []\n");
79+writeFile(path.join(repo, ".github/actions/ensure-base-commit/action.yml"), "name: ensure\n");
80+git(repo, "add", ".");
81+git(repo, "commit", "-qm", "initial");
82+83+fs.appendFileSync(path.join(repo, ".github/actions/ensure-base-commit/action.yml"), "# changed\n");
84+const argsPath = path.join(repo, "opengrep-args.txt");
85+const binDir = path.join(repo, "bin");
86+fs.mkdirSync(binDir);
87+writeFile(
88+path.join(binDir, "opengrep"),
89+[
90+"#!/usr/bin/env bash",
91+`printf '%s\\n' "$@" > ${JSON.stringify(argsPath)}`,
92+"exit 0",
93+"",
94+].join("\n"),
95+);
96+fs.chmodSync(path.join(binDir, "opengrep"), 0o755);
97+98+execFileSync("bash", ["scripts/run-opengrep.sh", "--changed", "--sarif", "--error"], {
99+cwd: repo,
100+env: {
101+ ...process.env,
102+PATH: `${binDir}${path.delimiter}${process.env.PATH ?? ""}`,
103+OPENCLAW_OPENGREP_BASE_REF: "HEAD",
104+},
105+encoding: "utf8",
106+});
107+108+const sarif = JSON.parse(
109+fs.readFileSync(path.join(repo, ".opengrep-out/precise.sarif"), "utf8"),
110+);
111+expect(sarif.version).toBe("2.1.0");
112+expect(sarif.runs[0].tool.driver.name).toBe("Opengrep OSS");
113+expect(sarif.runs[0].tool.driver.semanticVersion).toBe("1.22.0");
114+expect(sarif.runs[0].results).toEqual([]);
115+expect(fs.existsSync(argsPath)).toBe(false);
116+});
117+71118it("scans PR files instead of main-only files when the payload base is stale", () => {
72119const repo = createTempDir("openclaw-run-opengrep-merge-");
73120git(repo, "init", "-q", "--initial-branch=main");
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。