fix(govulncheck): reject SARIF reports with a clear error pointing to the SARIF scan type

docs/content/supported_tools/parsers/file/govulncheck.md

@@ -27,6 +27,14 @@ original parser:
 
 The original **Govulncheck Scanner** parser is unchanged and remains available.
 
+### SARIF format
+
+The Govulncheck Scanner parsers only accept govulncheck's native JSON output
+(`govulncheck -format json`). To import govulncheck's SARIF output
+(`govulncheck -format sarif`), use the generic **SARIF** scan type instead — not
+the Govulncheck Scanner scan type. Uploading a SARIF report to a Govulncheck
+Scanner parser fails with an error pointing you to the SARIF scan type.
+
 ### Sample Scan Data
 Sample Govulncheck scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/govulncheck).
 

dojo/tools/govulncheck/parser.py

@@ -40,6 +40,23 @@ def load_govulncheck_stream(scan_file):
         return data
 
 
+def raise_if_sarif(data):
+    """
+    Govulncheck can emit SARIF (``govulncheck -format sarif``). That format is
+    not handled by these parsers; the dedicated SARIF parser should be used
+    instead. Detect it and fail with a clear, actionable message rather than an
+    opaque KeyError or a silently empty result.
+    """
+    if isinstance(data, dict) and "runs" in data:
+        msg = (
+            "This looks like a SARIF report (it has a top-level 'runs' key). "
+            "The Govulncheck Scanner parser only accepts govulncheck's native "
+            "JSON output (govulncheck -format json). To import govulncheck SARIF "
+            "output (govulncheck -format sarif), use the 'SARIF' scan type instead."
+        )
+        raise ValueError(msg)
+
+
 class GovulncheckParser:
     def get_scan_types(self):
         return ["Govulncheck Scanner"]
@@ -139,6 +156,7 @@ def get_findings(self, scan_file, test):
             msg = "Invalid JSON format"
             raise ValueError(msg)
         else:
+            raise_if_sarif(data)
             if isinstance(data, dict):
                 if data["Vulns"]:
                     # Parsing for old govulncheck output format
@@ -352,6 +370,7 @@ def format_trace(trace):
 
     def get_findings(self, scan_file, test):
         data = load_govulncheck_stream(scan_file)
+        raise_if_sarif(data)
         # The v2 parser only targets the new streaming format (a list of objects).
         if not isinstance(data, list):
             return []