CI and code scanning

Add it to a workflow

Run the check, write a SARIF log, then hand the log to code scanning. The two steps are independent, so the check still fails the job on its own.

name: Data contract
on: [push, pull_request]

jobs:
  datapact:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.x

      - name: Check the contract
        run: bunx github:srivtx/datapact#main check --contract contract.yaml --data data.csv --fail-on warning --sarif datapact.sarif

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: datapact.sarif

What a SARIF result contains

Each finding becomes one SARIF result:

• ruleId is the rule code, such as DP-208.
• level is mapped from severity: error to error, warning to warning, and info to note.
• The physical location points at the data file, so the annotation lands on the pull request.
• properties.severity carries the original severity, and the rule metadata describes each code.

The log is SARIF 2.1.0, the format GitHub code scanning understands.

Failing the build

Without --sarif, the exit code is the gate. datapact check exits 1 on any error-severity finding. Add --fail-on warning to fail on warnings too, or --fail-on info to fail on anything. The flag changes only the exit code; the report is the same either way. A contract or CSV that cannot be parsed exits 2 and is never reported as clean.

$ datapact check --contract contract.yaml --data data.csv --fail-on warningdata.csv  rows:5  errors:16  warnings:0  info:1INFO   DP-202  discount_code  column "discount_code" is not declared in the contractERROR  DP-208  orders.order_id  row 2: value "ORD-2" does not match pattern ^ORD-[0-9]{6}$ERROR  DP-205  orders.order_id  row 4: duplicate value "ORD-000101" in unique column "order_id"ERROR  DP-201  orders.is_gift  required column "is_gift" is missing from the dataset… 13 more findings.exit 1