fix: SARIF validation and skip tests in CI security scan

- Fix SARIF validation error: suggestion without artifactChanges
- Add --skip-tests to security scan to skip test pattern code

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: bumahkib7

.github/workflows/ci.yml

@@ -174,4 +174,5 @@ jobs:
         with:
           path: '.'
           profile: 'strict'
+          extra-args: '--skip-tests'
           upload-sarif: true

crates/cli/src/output/sarif.rs

@@ -157,12 +157,12 @@ pub fn output(results: &[FileAnalysis], output_file: Option<PathBuf>) -> Result<
                             }]
                         }]);
                     } else if let Some(suggestion) = &f.suggestion {
-                        // Fall back to simple description-only fix for backward compatibility
-                        result["fixes"] = serde_json::json!([{
-                            "description": {
-                                "text": suggestion
-                            }
-                        }]);
+                        // SARIF spec requires artifactChanges for fixes
+                        // Append suggestion to the message instead
+                        if let Some(text) = result["message"]["text"].as_str() {
+                            result["message"]["text"] =
+                                serde_json::json!(format!("{}\n\nSuggestion: {}", text, suggestion));
+                        }
                     }
 
                     // Add properties with additional metadata