Build SARIF Exporter for Native GitHub/GitLab Integration

[squid-protocol]

Epic: #75
Target: gitgalaxy/recorders/sarif_recorder.py & galaxyscope.py

Context & Strategic Value

To be adopted by enterprise engineering teams, GitGalaxy cannot force users to learn a new dashboard. We must bring our findings directly to the developer's pull request. By exporting our Structural Signatures and Risk Vectors into the OASIS-compliant SARIF format, GitHub Advanced Security (GHAS), GitLab, and Azure DevOps will automatically ingest our telemetry and annotate code in real-time.

Implementation Tasks

• Create gitgalaxy/recorders/sarif_recorder.py.
• Initialize the SARIF JSON structure with the required version: "2.1.0" and runs array.
• Map GitGalaxy telemetry into the tool.driver.rules array.
  • Example: A high_risk_execution spike becomes a formalized rule object.
• Map spatial hit_vector coordinates into SARIF physicalLocation blocks.
  • Note: You must translate regex byte offsets or matched indices into actual line numbers (URI and startLine/endLine).
• [NATIVE INTEGRATION] Update galaxyscope.py to import SarifRecorder. Append it to the final export block alongside JSON and SQLite to generate gitgalaxy_results.sarif by default.

Validation

Run a local scan generating the .sarif file. Upload it to a test GitHub repository using the github/codeql-action/upload-sarif action. Verify that GitGalaxy risk findings appear natively under the "Security" tab and inline on PR diffs.