I'm also trying to use detekt 1.16.0 + SARIF + CodeQL Action. But for some reason the SARIF has empt...

# detekt

[Sebastian Schuberth]

I'm also trying to use detekt 1.16.0 + SARIF + CodeQL Action. But for some reason the SARIF has empty "results" : [ ] although on the CLI I see issues. Any idea why that could be? Who wants to try, use the detekt-action branch from https://github.com/oss-review-toolkit/ort.

[chao]

Did you upgrade to detekt 1.16?

[Sebastian Schuberth]

Yes.

[Sebastian Schuberth]

Looks like the issue is with merging reports. I had not enabled merging, so I'm probably overwriting the "global" report with one of the sub-project reports that has no findings.

[Sebastian Schuberth]

So, when I'm using the code at https://github.com/detekt/detekt/blob/master/docs/pages/reporting.md#kotlin-dsl to merge reports, I'm getting error Parameter specified as non-null is null: method org.gradle.kotlin.dsl.NamedDomainObjectCollectionExtensionsKt.getValue, parameter $this$getValue, any hints what's wrong?

[chao]

If you have some branches showing the code, I can help reproduce.

[chao]

I consider myself a noob for kts, so I probably need more information to figure out what’s wrong

[chao]

An actual closer example is here as gradle testkit integration test. I copied my test code into the documentation

[Sebastian Schuberth]

Any help is appreciated. Regaring a branch to reproduce, please see my initial post: use the detekt-action branch from https://github.com/oss-review-toolkit/ort.

[chao]

You need to move

val mergeDetektReports by tasks.registering(ReportMergeTask::class) {
    output.set(rootProject.buildDir.resolve("reports/detekt/merged.sarif"))
}

ahead of allprojects

[Sebastian Schuberth]

Wow, thanks a lot, that works indeed!

[Sebastian Schuberth]

PS: I just filed a PR to use finalizedBy() for the merge task, see https://github.com/detekt/detekt/pull/3548.

[chao]

Sounds good. I usually do --continue but I guess this setup is much cleaner

[chao]

@Sebastian Schuberth Is the Github action now working for you? I am trying to determine the urgency of merging https://github.com/detekt/detekt/pull/3556

[Sebastian Schuberth]

Yes, it's working, though the PR is not merged yet, see https://github.com/oss-review-toolkit/ort/pull/3749

[chao]

🙏