Fix for Issue #1482 - SARIF artifactChanges null validation error

[ravisastryk]

Summary

Only create Fix object when autofix is non-empty to avoid null artifactChanges. Fixes #1482.

Problem

GitHub's CodeQL upload-sarif action was rejecting SARIF files generated by gosec with the error:

instance.runs[0].results[23].fixes[0].artifactChanges is not of a type(s) array

Root Cause: The Fix object was being created unconditionally, even when autofix was empty. This resulted in ArtifactChanges being null in the JSON output, which violates the SARIF 2.1.0 schema requirement that artifactChanges must be a non-empty array when present.

Solution

Only create the Fix object when autofix content is non-empty. This ensures:

• No fixes field when there's no fix suggestion (schema-compliant)
• Valid artifactChanges array when fix exists (schema-compliant)

Tests

• Made sure all existing tests run along with existing SARIF tests
• New test added to validate fix

[ravisastryk]

@ccojocar Please take a look at this PR when you get a chance. Folks have been waiting to get a release instead of doing some workarounds. It would be a nice for gosec adoption in the community.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.23%. Comparing base (1216c9b) to head (3952481).
⚠️ Report is 173 commits behind head on master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1483      +/-   ##
==========================================
+ Coverage   68.49%   69.23%   +0.73%     
==========================================
  Files          75       83       +8     
  Lines        4384     6663    +2279     
==========================================
+ Hits         3003     4613    +1610     
- Misses       1233     1825     +592     
- Partials      148      225      +77     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.