Merge branch 'main' into guibranco-patch-1

Author: gstraccini[bot]

.github/workflows/codacy.yml

@@ -48,30 +48,23 @@ jobs:
           gh-code-scanning-compat: true
           max-allowed-issues: 2147483647
 
-      # 3️⃣ Extract only the first SARIF run to avoid duplicates
-      - name: Extract first SARIF run
-        run: |
-          jq '{version: .version, "$schema": ."$schema", runs: [ .runs[0] ]}' results.sarif > filtered.sarif
-
-      # 4️⃣ Upload just that single-run SARIF
+      # 3️⃣ Split and upload each SARIF run
       - name: Split and upload each SARIF run
         run: |
           count=$(jq '.runs | length' results.sarif)
           for i in $(seq 0 $((count-1))); do
             jq --argjson idx $i \
                '{version: .version, "$schema": ."$schema", runs: [ .runs[$idx] ]}' \
                results.sarif > run_${i}.sarif
-      
-            # gzip and base64 encode
-            gzip -c run_${i}.sarif | base64 -w 0 > run_${i}.sarif.b64
-      
-            # Read encoded content into variable
-            b64_sarif=$(cat run_${i}.sarif.b64)
-      
-            gh api repos/${{ github.repository }}/code-scanning/sarifs \
-              -f commit_sha=${{ github.sha }} \
-              -f ref=${{ github.ref }} \
-              -f sarif="$b64_sarif"
+
+            # Build a valid JSON payload and pipe directly into gh api
+            gzip -c run_${i}.sarif | base64 -w 0 | \
+              jq -Rs \
+                --arg commit_sha "${{ github.sha }}" \
+                --arg ref "${{ github.ref }}" \
+                '{commit_sha: $commit_sha, ref: $ref, sarif: (. | rtrimstr("\n"))}' | \
+              gh api repos/${{ github.repository }}/code-scanning/sarifs \
+                --input -
           done
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/infisical-secrets-check.yml

@@ -23,4 +23,4 @@ jobs:
           fetch-depth: 0
 
       - name: Infisical secrets check
-        uses: guibranco/github-infisical-secrets-check-action@v4.2.2
+        uses: guibranco/github-infisical-secrets-check-action@v5.0.1