mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
sarif results were hardcoded to level "warning", so a critical finding and an informational one landed identically in code-scanning ingests. carry the normalized severity onto report.Result and map it: critical and high to error, medium to warning, low and info to note. the severity is derived by flattening each module result and taking the worst rank, and an absent severity keeps the old "warning" default.