Fix snyk scanning (#511)

See
https://github.blog/changelog/2025-07-21-code-scanning-will-stop-combining-multiple-sarif-runs-uploaded-in-the-same-sarif-file/

Fixes #405

Author: julienp

.github/scripts/filter-sarif.py

@@ -14,6 +14,13 @@
     # Keep at least one run
     runs = runs if len(runs) > 0 else [sarif["runs"][0]]
 
+    # GitHub expects each tool to only create 1 run, but Snyk splits the results
+    # across multiple runs. As a workaround, we rename the tools for each run to
+    # ensure they are unique within the file.
+    # https://github.blog/changelog/2025-07-21-code-scanning-will-stop-combining-multiple-sarif-runs-uploaded-in-the-same-sarif-file/
+    for i, run in enumerate(runs):
+        run["tool"]["driver"]["name"] += f"_{i}"
+
     sarif["runs"] = runs
 
     with open("out.sarif", "w") as out: