Fix #14006 (CI: upload cppcheck premium sarif results to github)

[danmar]

No description provided.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[danmar]

@Nettozx I would like your feedback about removing the "security-value". Will it still be compatible with your tooling?

github write some strange error message when we have it..

[Nettozx]

@Nettozx I would like your feedback about removing the "security-value". Will it still be compatible with your tooling?

github write some strange error message when we have it..

Can you show me the error message it was showing? I haven't had issues uploading cppcheck sarif files with the changes in my fork

[Nettozx]

Oh I see. I resolved this in my fork, its due to it passing the severity as a number instead of a string.

[danmar]

@Nettozx the security-value problem is shown now. From the log:

Error: Code Scanning could not process the submitted SARIF file:
parsing restricted subset of SARIF data has failed: parse error: expected string near offset 115277 of '9.9'

The sarif results can be downloaded if you want to look closer on it.

If you have a better suggestion let me know..

[danmar]

Oh I see. I resolved this in my fork, its due to it passing the severity as a number instead of a string.

ah ok.. I will try that!

[danmar]

@Nettozx thanks, as far as I see this works now.. let's see what happens if I turn on all CI..

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud