From 80903c1b83719be20f0f006b13eca9a390dc6568 Mon Sep 17 00:00:00 2001
From: Soner Sayakci <s.sayakci@gmail.com>
Date: Mon, 27 Jul 2026 08:21:31 +0200
Subject: [PATCH] ci: set unique SARIF category per scanned image in security
 workflow

All 32 matrix jobs uploaded trivy SARIF results with no category, so
they shared a single code-scanning analysis. The last job to finish
became the 'current' analysis, causing alerts from the other images to
be resolved and reopened on every run - nothing ever stayed fixed.

Give each matrix combination (PHP version + variant) its own category
so alerts resolve automatically once the vulnerability is gone from
the published image.
---
 .github/workflows/security.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index cf08a29..5843008 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -59,3 +59,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
+          category: ${{ matrix.php-version }}-${{ matrix.variant.name }}