feat: Implement SARIF output format for native GitHub Code Scanning integration

[Nanle-code]

Overview

GitHub's Code Scanning feature natively ingests SARIF (Static Analysis Results Interchange Format) files and displays findings as inline annotations directly in pull request diffs and the repository's Security tab. By adding a SARIF output format to ChainProof, we can integrate with this first-class GitHub security workflow without relying on the custom PR comment approach currently used in the GitHub Action.

Current State

The GitHub Action currently posts findings as a PR comment and uses core.error() / core.warning() for inline annotations. These are functional but:

• PR comments are noisy and do not persist in the Security tab
• core.error() annotations disappear after the workflow run
• No integration with GitHub's security dashboard or secret scanning UI

SARIF Format Overview

{
  "version": "2.1.0",
  "runs": [{
    "tool": {
      "driver": {
        "name": "ChainProof",
        "version": "1.0.0",
        "rules": [ /* rule metadata */ ]
      }
    },
    "results": [
      {
        "ruleId": "CP-107",
        "level": "error",
        "message": { "text": "Reentrancy vulnerability detected" },
        "locations": [{
          "physicalLocation": {
            "artifactLocation": { "uri": "contracts/Vault.sol" },
            "region": { "startLine": 42, "endLine": 48 }
          }
        }]
      }
    ]
  }]
}

Proposed Changes

Core Package

Add generateSARIFReport(result: ScanResult): string to packages/core/src/report/generator.ts

Severity mapping:

ChainProof	SARIF Level
critical	error
high	error
medium	warning
low	note
info	none
gas	none

CLI

Add --format sarif option, defaulting output file to chainproof-results.sarif

GitHub Action

1. Generate SARIF file during action run
2. Upload via github/codeql-action/upload-sarif@v3
3. Remove dependency on core.error() annotations (replaced by SARIF)

Acceptance Criteria

• generateSARIFReport() implemented and exported from core
• SARIF output validates against the official SARIF 2.1.0 JSON schema
• CLI --format sarif flag implemented
• GitHub Action uploads SARIF and findings appear in Security tab
• Rule metadata (id, name, help URI) included in SARIF tool.driver.rules
• Tested against GitHub's SARIF validator

References

• SARIF 2.1.0 Specification
• GitHub Code Scanning — SARIF support
• github/codeql-action upload-sarif