upload-sarif does not handle relative paths when trivy runs on a subfolder

Reproduce the workflow shown with Trivy scanning terraform/01-bootstrap and upload-sarif, then inspect the upload-sarif action and the referenced analyze/action.yml checkout_path entry. Compare how relative artifact URIs, uriBaseId, and checkout paths are handled; done means findings appear under paths such as terraform/01-bootstrap/eks.tf in the security tab.

Originally posted by @rofreytag in #2215

I run into an issue when using trivy config scan on a subfolder. The reported issues appear in the security tab, but the folder/path reference of files inside the repo is not correctly presented.

Example finding:

The expected path should be terraform/01-bootstrap/eks.tf.

The generated sarif file by trivy:

• uses URLs relative to terraform/some-module (i.e. main.tf)
• uses relative URLs for module invocations like ../modules/other-module/main.tf.
• includes the correct uriBaseId

GitHub interprets all these URls relative to the repo root without using uriBaseId.

I am happy to try a workaround, but currently

• I can not yet find a way to make trivy generate absolute URLs, which I believe resolves the issue.
• Neither can I tell the upload-action that I am using relative URLs in my repo

expected behavior

Either have the upload-action use the uriBaseId of the sarif file, or

have an existing param like checkout_path (or a new param) in the action, to respect and transform relative URLs, so that they correctly appear in the report.

Example:

     - name: Upload Trivy scan results to GitHub Security tab
       uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
       with:
         sarif_file: 'trivy-results.sarif'
         category: trivy-my-module
         checkout_path: ${{ github.workspace }}/terraform/01-bootstrap/

Here an excerpt of the generated sarif file that shows the URLs of each finding

          "message": {
            "text": "Artifact: eks.tf\nType: terraform\nVulnerability aws-vpc-add-description-to-security-group-rule\nSeverity: LOW\nMessage: Security group rule does not have a description.\nLink: [aws-vpc-add-description-to-security-group-rule](https://avd.aquasec.com/misconfig/aws-vpc-add-description-to-security-group-rule)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "eks.tf",
                  "uriBaseId": "ROOTPATH"
                },

          "message": {
            "text": "Artifact: ../modules/rdb/main.tf\nType: terraform\nVulnerability AVD-AWS-0098\nSeverity: LOW\nMessage: Secret explicitly uses the default key.\nLink: [AVD-AWS-0098](https://avd.aquasec.com/misconfig/avd-aws-0098)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "../modules/rdb/main.tf",
                  "uriBaseId": "ROOTPATH"
                },

and the originalUriBaseId section at the end:

      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "file:///home/runner/work/redacted/redacted/terraform/01-bootstrap/"
        }
      }
    }
  ]
}

Here is my full workflow file

name: Code Scan

on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]
  schedule:
    - cron: '27 23 * * 2'

permissions:
  contents: read # for actions/checkout to fetch code
  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
  actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

jobs:
  analyze-tf:
    runs-on: ubuntu-latest
    name: Analyze (${{ matrix.config.path }})
    strategy:
      matrix:
        config:
        - path: terraform/00-shared
          varfile: configs/sai-shared-prod.tfvars
        - path: terraform/01-bootstrap
          varfile: configs/sai-prod.tfvars
        - path: terraform/02-k8s
          varfile: configs/sai-prod.tfvars
        - path: terraform/03-services
          varfile: configs/sai-prod.tfvars

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run Trivy scanner
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 #v0.30.0
        with:
          scan-type: 'config'
          scan-ref: ${{ matrix.config.path }}
          tf-vars: ${{ matrix.config.path }}/${{ matrix.config.varfile }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          version: v0.61.1

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
        with:
          sarif_file: 'trivy-results.sarif'
          # need to add unique category, so the results in one commit do not overwrite each other
          category: trivy-${{ matrix.config.path }}
          # I tried this with no luck
          # checkout_path: ${{ github.workspace }}/${{ matrix.config.path }}/