ci: write filtered Scorecard SARIF separately

Write Scorecard SARIF filtering output to a new file so Docker-owned results.sarif does not need to be overwritten before upload.

Author: mmmprod

.github/scripts/filter-scorecard-sarif.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { readFileSync, writeFileSync } from "node:fs";
 
-const [file = "results.sarif"] = process.argv.slice(2);
-const sarif = JSON.parse(readFileSync(file, "utf8"));
+const [inputFile = "results.sarif", outputFile = inputFile] = process.argv.slice(2);
+const sarif = JSON.parse(readFileSync(inputFile, "utf8"));
 
 for (const run of sarif.runs ?? []) {
   if (!Array.isArray(run.results)) {
@@ -12,4 +12,4 @@ for (const run of sarif.runs ?? []) {
   run.results = run.results.filter((result) => result.ruleId !== "SASTID");
 }
 
-writeFileSync(file, `${JSON.stringify(sarif)}\n`);
+writeFileSync(outputFile, `${JSON.stringify(sarif)}\n`);

.github/workflows/scorecard.yml

@@ -43,9 +43,9 @@ jobs:
       # CodeQL uploads the real SAST results. Scorecard's SAST meta-check is
       # noisy for multi-commit pushes because checks attach to the head commit.
       - name: Drop Scorecard SAST meta-alert
-        run: node .github/scripts/filter-scorecard-sarif.mjs results.sarif
+        run: node .github/scripts/filter-scorecard-sarif.mjs results.sarif results.filtered.sarif
 
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
         with:
-          sarif_file: results.sarif
+          sarif_file: results.filtered.sarif