[sonukapoor]

SARIF locations are emitted relative to %SRCROOT%, but the URI was the lockfile's bare filename. So a scan of a subdirectory reported every finding against a lockfile at the repository root, and Code Scanning put the alerts on a file without those dependencies, or on one that does not exist.

The lockfile is now measured from the launch directory, which is the checkout root on every path that uploads to Code Scanning: our Action runs each scan from the workspace and passes the target as an argument. A scan run at the project root still emits the bare filename, so single-project setups see no change. A lockfile above the launch directory, or on another Windows drive, falls back to the bare filename rather than emitting an invalid location.

This deliberately differs from the HTML report, which measures from the scanned project because it is read wherever it is pasted (#1271). Each artefact measures from wherever it is consumed.

Scanning examples/direct-fixable from the repository root: before, all 26 results were located at package-lock.json; now all 26 are at examples/direct-fixable/package-lock.json. The same scan run from inside the project is unchanged, and the findings are identical in both.

Worth a line in the release notes: some adopters work around this by prefixing the folder onto SARIF paths themselves before uploading. Once they upgrade, that step would double the prefix, so it should be removed.

Closes #1380

[Copilot]

🟡 Changes recommended

Directory names containing reserved URI characters remain unescaped and can cause SARIF locations to resolve to incorrect files.

1 open issue

• URI-encode directory path segments to preserve literal names · New

What changed in this PR

This PR corrects SARIF lockfile locations for subdirectory scans by measuring paths from the launch directory, aligning them with the checkout root used by the Action’s Code Scanning uploads.

Changes:

• Emit relative lockfile paths while preserving bare filenames for root scans and unsupported relative paths.
• Add tests for root, subdirectory, relative, and missing paths.
• Add Windows-specific coverage for separator normalization and cross-drive fallback.

File	Description
tests/​sarif.test.ts	Tests launch-directory-relative paths and fallback behavior.
tests/​sarif-lockfile-uri-win32.test.ts	Tests Windows separators and cross-drive fallback.
src/​output/​sarif.ts	Derives SARIF lockfile paths relative to the launch directory.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused implementation matches the intended location contract, preserves fallback behavior, and includes regression coverage with no unresolved findings.

No open issues 🎉

1 resolved since last review

• URI-encode directory path segments to preserve literal names

_{Review effort: Balanced}