From c47ba403c642d342f27a64fcdfbf00d25ef41fd6 Mon Sep 17 00:00:00 2001
From: Piotr Paradzinski <dancingwithopenheart@gmail.com>
Date: Sun, 7 Jun 2026 08:47:53 +0200
Subject: [PATCH] * add option enrich-sarif * if the option is set use
 cabal-plan-submit to add to report proper locations, and paths to dependency
 * fails script on unused variables and errors in commands set -euo pipefail

---
 action.yaml | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/action.yaml b/action.yaml
index b3bece9..a6fe2cd 100644
--- a/action.yaml
+++ b/action.yaml
@@ -16,6 +16,10 @@ inputs:
     description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
     required: false
     default: ${{ github.token }}
+  enrich-sarif:
+    description: "Enrich cabal-audit SARIF with dependency paths from Cabal plan.json using cabal-plan-submit."
+    required: false
+    default: "true"
 
 outputs:
   sarif-id:
@@ -29,17 +33,40 @@ runs:
       shell: bash
       env:
         CHECKOUT_PATH: ${{ inputs.checkout_path }}
+        ENRICH_SARIF: ${{ inputs.enrich-sarif }}
       run: |
+        set -euo pipefail
         cd "$CHECKOUT_PATH"
         wget https://github.com/MangoIV/cabal-audit/releases/download/nightly/cabal-audit
         chmod +x cabal-audit
+        if [[ "$ENRICH_SARIF" == "true" ]]; then
+          cabal update
+          cabal install cabal-plan-submit \
+            --installdir "$RUNNER_TEMP/bin" \
+            --overwrite-policy=always
+        fi
     - name: Run Haskell Security Action
       shell: bash
       env:
         CHECKOUT_PATH: ${{ inputs.checkout_path }}
+        ENRICH_SARIF: ${{ inputs.enrich-sarif }}
       run: |
+        set -euo pipefail
         cd "$CHECKOUT_PATH"
-        ./cabal-audit --sarif --to-file results.sarif
+        ./cabal-audit --sarif --to-file cabal-audit.sarif
+        if [[ "$ENRICH_SARIF" == "true" ]]; then
+          cabal build all --dry-run
+          if [[ ! -f dist-newstyle/cache/plan.json ]]; then
+            echo "Expected dist-newstyle/cache/plan.json after cabal build all --dry-run"
+            exit 1
+          fi
+          "$RUNNER_TEMP/bin/cabal-plan-submit" enrich-sarif \
+            dist-newstyle/cache/plan.json \
+            cabal-audit.sarif \
+            > results.sarif
+        else
+          cp cabal-audit.sarif results.sarif
+        fi
         cat results.sarif
     - name: Upload SARIF file
       id: upload-sarif