cli: add a "GitHub" output format (#634)

* cli: add a "GitHub" output format

Closes #633.

Signed-off-by: William Woodruff <william@yossarian.net>

* try using SARIF path

Signed-off-by: William Woodruff <william@yossarian.net>

* fix lines

Signed-off-by: William Woodruff <william@yossarian.net>

* fmt

Signed-off-by: William Woodruff <william@yossarian.net>

* add --no-exit-codes

Signed-off-by: William Woodruff <william@yossarian.net>

* bump help snippet

Signed-off-by: William Woodruff <william@yossarian.net>

* bump snippet

Signed-off-by: William Woodruff <william@yossarian.net>

* integration test for github output

Signed-off-by: William Woodruff <william@yossarian.net>

* github: output tweaks

* update snapshot

* test-output: test GitHub output on just one file

* remove columns

* bump snapshot

* try something else

Signed-off-by: William Woodruff <william@yossarian.net>

* fixup snapshot

Signed-off-by: William Woodruff <william@yossarian.net>

* one last hack

Signed-off-by: William Woodruff <william@yossarian.net>

* add primary annotation to message

Signed-off-by: William Woodruff <william@yossarian.net>

* usage: document --format=github, add integration docs

Signed-off-by: William Woodruff <william@yossarian.net>

* docs: update release notes

---------

Signed-off-by: William Woodruff <william@yossarian.net>

Author: woodruffw

.github/workflows/test-sarif.yml .github/workflows/test-output.yml.github/workflows/test-sarif.yml renamed to .github/workflows/test-output.yml

@@ -1,4 +1,4 @@
-name: Test SARIF Presentation
+name: Test output formats
 
 on:
   pull_request:
@@ -46,3 +46,26 @@ jobs:
               repo: context.repo.repo,
               body: `:robot: Presentation results: <${url}>`
             })
+
+  test-github-presentation:
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'test-github-presentation')
+    permissions: {}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
+
+      - name: Run zizmor
+        run: |
+          # Normally we'd want a workflow to fail if the audit fails,
+          # but we're only testing presentation here.
+          cargo run \
+            -- \
+            --no-exit-codes \
+            --format github \
+            tests/integration/test-data/several-vulnerabilities.yml

docs/release-notes.md

@@ -9,6 +9,14 @@ of `zizmor`.
 
 ## Next (UNRELEASED)
 
+### New Features 🌈
+
+* `zizmor` now supports `--format=github` as an output format.
+  This format produces check annotations via GitHub workflow commands,
+  e.g. `::warning` and `::error`. See the
+  [Output formats](./usage.md#output-formats) documentation for more information
+  on annotations, including key limitations (#634)
+
 ### Improvements 🌱
 
 * The SARIF output format now marks each rule as a "security" rule,

docs/snippets/help.txt

@@ -25,7 +25,7 @@ Options:
       --no-progress
           Don't show progress bars, even if the terminal supports them
       --format <FORMAT>
-          The output format to emit. By default, plain text will be emitted [default: plain] [possible values: plain, json, sarif]
+          The output format to emit. By default, cargo-style diagnostics will be emitted [default: plain] [possible values: plain, json, sarif, github]
       --color <MODE>
           Control the use of color in output [possible values: auto, always, never]
   -c, --config <CONFIG>