From 42ab40d07958003fd08f66956681274bae26fe88 Mon Sep 17 00:00:00 2001
From: "Andoni A." <14891798+andoniaf@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:48:43 +0200
Subject: [PATCH] fix(sdk): drop partialFingerprints from SARIF output

Let github/codeql-action/upload-sarif compute fingerprints from file
content instead of using Prowler UIDs, which conflict with GitHub's
expected format.
---
 prowler/lib/outputs/sarif/sarif.py    | 3 ---
 prowler/lib/outputs/summary_table.py  | 5 +++++
 tests/lib/outputs/sarif/sarif_test.py | 2 --
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/prowler/lib/outputs/sarif/sarif.py b/prowler/lib/outputs/sarif/sarif.py
index 16df56db32..c1e2acce66 100644
--- a/prowler/lib/outputs/sarif/sarif.py
+++ b/prowler/lib/outputs/sarif/sarif.py
@@ -72,9 +72,6 @@ class SARIF(Output):
                 "ruleIndex": rule_index,
                 "level": SEVERITY_TO_SARIF_LEVEL.get(severity, "note"),
                 "message": {"text": finding.status_extended},
-                "partialFingerprints": {
-                    "primaryLocationLineHash": finding.uid,
-                },
             }
 
             location = self._build_location(finding)
diff --git a/prowler/lib/outputs/summary_table.py b/prowler/lib/outputs/summary_table.py
index 635139117d..1f30063c8f 100644
--- a/prowler/lib/outputs/summary_table.py
+++ b/prowler/lib/outputs/summary_table.py
@@ -9,6 +9,7 @@ from prowler.config.config import (
     json_asff_file_suffix,
     json_ocsf_file_suffix,
     orange_color,
+    sarif_file_suffix,
 )
 from prowler.lib.logger import logger
 from prowler.providers.github.models import GithubAppIdentityInfo, GithubIdentityInfo
@@ -207,6 +208,10 @@ def display_summary_table(
                 print(
                     f" - HTML: {output_directory}/{output_filename}{html_file_suffix}"
                 )
+            if "sarif" in output_options.output_modes:
+                print(
+                    f" - SARIF: {output_directory}/{output_filename}{sarif_file_suffix}"
+                )
 
         else:
             print(
diff --git a/tests/lib/outputs/sarif/sarif_test.py b/tests/lib/outputs/sarif/sarif_test.py
index 2307d7406b..32f5551f4a 100644
--- a/tests/lib/outputs/sarif/sarif_test.py
+++ b/tests/lib/outputs/sarif/sarif_test.py
@@ -40,7 +40,6 @@ class TestSARIF:
         assert result["ruleIndex"] == 0
         assert result["level"] == "error"
         assert result["message"]["text"] == "S3 bucket is not encrypted"
-        assert result["partialFingerprints"]["primaryLocationLineHash"] is not None
 
     def test_transform_pass_finding_excluded(self):
         finding = generate_finding_output(status="PASS", severity="high")
@@ -234,7 +233,6 @@ class TestSARIF:
         assert "ruleIndex" in result
         assert "level" in result
         assert "message" in result
-        assert "partialFingerprints" in result
         assert "locations" in result
 
         loc = result["locations"][0]["physicalLocation"]