{"record":{"id":"b7bc17607e42daf9","repo":"can1357/oh-my-pi","slug":"sarif-artifact-uri-must-resolve-to-a-repository-fi","errorCode":null,"errorMessage":"SARIF artifact URI must resolve to a repository file: ${uri}","messagePattern":"SARIF artifact URI must resolve to a repository file: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/importers/sarif.ts","lineNumber":117,"sourceCode":"async function resolveSarifArtifactPath(\n\tartifact: SarifArtifactLocation,\n\trun: SarifRun,\n\trepositoryRoot: string,\n): Promise<string> {\n\tconst uri = artifact.uri;\n\tif (!uri) throw new Error(\"SARIF artifact location is missing its URI\");\n\tconst rootUrl = pathToFileURL(`${repositoryRoot}${path.sep}`);\n\tlet baseUrl = rootUrl;\n\tif (artifact.uriBaseId) {\n\t\tconst declaredBase = run.originalUriBaseIds?.[artifact.uriBaseId]?.uri;\n\t\tif (!declaredBase && artifact.uriBaseId !== \"%SRCROOT%\") {\n\t\t\tthrow new Error(`SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}`);\n\t\t}\n\t\tbaseUrl = declaredBase ? new URL(declaredBase, rootUrl) : rootUrl;\n\t}\n\tconst resolvedUrl = new URL(uri.replaceAll(\"\\\\\", \"/\"), baseUrl);\n\tif (resolvedUrl.protocol !== \"file:\") {\n\t\tthrow new Error(`SARIF artifact URI must resolve to a repository file: ${uri}`);\n\t}\n\tconst absolute = path.resolve(fileURLToPath(resolvedUrl));\n\tif (!pathIsWithin(absolute, repositoryRoot)) {\n\t\tthrow new Error(`SARIF artifact resolves outside the repository: ${uri}`);\n\t}\n\tconst canonical = await fs.realpath(absolute).catch(error => {\n\t\tif (error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return absolute;\n\t\tthrow error;\n\t});\n\tif (!pathIsWithin(canonical, repositoryRoot)) {\n\t\tthrow new Error(`SARIF artifact resolves outside the repository through a symbolic link: ${uri}`);\n\t}\n\treturn path.relative(repositoryRoot, canonical).replaceAll(path.sep, \"/\");\n}\n\nasync function normalizeSarifLocations(\n\tresult: SarifResult,\n\trun: SarifRun,","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/importers/sarif.ts#L99-L135","documentation":"After resolving the artifact URI against the declared base, the importer requires the result to be a file: URL — SARIF locations must point at repository files, not http(s), data, or other schemes. Non-file URIs cannot be mapped to a repository path and are rejected.","triggerScenarios":"The artifact uri (possibly combined with an originalUriBaseIds base) resolves to a URL whose protocol is not file: — e.g. uri \"https://example.com/x.ts\" or a base declared as an http URL.","commonSituations":"SARIF from CI that uploads artifacts and references them by URL; originalUriBaseIds entries pointing at hosted locations; relative URI that resolves against an http base.","solutions":["Change the artifact uri to a relative path (e.g. \"src/x.ts\") so it resolves against the repository root file URL","Replace http(s) originalUriBaseIds entries with file: URLs pointing inside the repository","Strip absolute remote URIs and rewrite them as repository-relative paths before import"],"exampleFix":"// before\n\"uri\": \"https://ci.example.com/artifacts/src/x.ts\"\n// after\n\"uri\": \"src/x.ts\"","handlingStrategy":"validation","validationCode":"const resolved = new URL(artifactLocation.uri.replaceAll(\"\\\\\", \"/\"), baseFileUrl);\nif (resolved.protocol !== \"file:\") {\n  throw new Error(`URI must resolve to a repository file, got ${resolved.protocol}`);\n}","typeGuard":"function isFileUrl(u: URL): boolean {\n  return u.protocol === \"file:\";\n}","tryCatchPattern":"try {\n  const bundle = await importSarif(sarifDir, repoRoot);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"SARIF artifact URI must resolve to a repository file\")) {\n    console.error(\"Rewrite the URI to a repo-relative path or a file: base before importing\");\n  } else throw err;\n}","preventionTips":["Configure scanners to emit relative paths, not hosted URLs","Ensure originalUriBaseIds entries use file: URLs, not http(s)","Pre-process CI-generated SARIF to strip remote artifact URLs","Prefer uri forms like \"src/x.ts\" that resolve against the repo-root file URL"],"tags":["sarif","import","uri-scheme"],"backgroundTag":"non-file-uri","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}