Generate unique automationDetails.id in SARIF output

[david-waltermire]

Summary

When uploading multiple SARIF files to GitHub Code Scanning (e.g., one per validated OSCAL document), each file needs a unique runs[].automationDetails.id so they are treated as separate analyses. Without this, uploads overwrite each other and alerts from earlier files get closed.

Current Behavior

oscal-cli (and the underlying metaschema-java SARIF generation) does not include automationDetails in the SARIF output. This requires post-processing with jq to inject it before uploading to GitHub.

Expected Behavior

The SARIF output should include a unique automationDetails.id per run, derived from the validated file path or name. For example:

{
  "runs": [{
    "automationDetails": {
      "id": "oscal-validation/content/nist/NIST_SP-800-53_rev5_catalog/"
    },
    ...
  }]
}

The id field is interpreted as category/run-id by GitHub. The category portion (before the final /) determines which analysis group the results belong to.

Context

• GitHub requires unique categories when uploading multiple SARIF files for the same tool and commit: https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
• As of July 2025, GitHub no longer combines multiple runs uploaded in the same SARIF file with the same category
• This was discovered while building a CI/CD pipeline that validates multiple OSCAL documents and uploads results individually via the code scanning API

[coderabbitai]

🔗 Related PRs

#137 - Ensure SARIF results are valid to SARIF JSON schema [merged]
metaschema-framework/liboscal-java#237 - feat: add detailed SARIF findings to security scan summaries [merged]
#631 - feat: add detailed SARIF findings to security scan summaries [merged]
metaschema-framework/oscal-cli#223 - feat: add detailed SARIF findings to security scan summaries [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!