[aimanmalib]

Closes #3.

Gap

crewforge review prints text, json and markdown. GitHub code scanning reads Static Analysis Results Interchange
Format (sarif) 2.1.0, and comparable review and lint tools already offer that output for CI:
scanaislop/aislop (aislop scan --sarif),
agent-sh/agentsys (agnix --format sarif),
duriantaco/skylos (--format sarif) and
hyhmrright/brooks-lint. crewforge had no such option.

What this adds

• -f sarif on crewforge review (a new click.Choice value; existing formats and exit codes 0/1/2 unchanged).
• report_sarif(result, sources, target) in recipes/review/report.py, written from the published specification with
  the standard library only. One run, tool.driver.name = "crewforge", one result per finding:
  critical/error as level error, warning as warning, info as note; ruleId is the finding's CWE, else
  the reviewer's name; the message is title, description and the suggested fix.
• Line mapping for directory reviews: Sources now records which lines of the joined # File: text belong to which
  file, and Sources.locate(line) maps a reported line back to (file, line). A line that is missing, not an integer,
  on a header or outside the code keeps the reviewed path with no region, so code scanning never points at a wrong line.
• Failed reviewers (with --allow-partial) are listed in invocations[0].toolExecutionNotifications and
  executionSuccessful is false. Without the flag a failed reviewer still exits 1 and no report is written.
• README: the Recipes row, a short section with an upload-sarif workflow example, and the Bahasa Melayu summary.
  CHANGELOG [0.3.0] credits aislop and agentsys; version 0.3.0 in pyproject.toml, __init__, CITATION.cff
  and the crewforge entry in uv.lock. No new dependency.

How it was tested

• tests/recipes/review/test_sarif.py (21 tests, fake endpoint, no API key): the CLI output has version == "2.1.0",
  $schema, runs[0].tool.driver.name == "crewforge" and one result per finding with the mapped level; failed
  reviewers still exit 1; --allow-partial marks the run unsuccessful and names the agent; each severity maps to its
  level; non-integer and out-of-range lines get no region; relative paths stay relative; and for a directory, every
  line of the joined text maps to the identical line in its own file.
• Each guard was removed in turn (the level map, the blank-line offset between files, the line mapping, the bool
  check, executionSuccessful) and the new tests went red each time.
• A sample log for a two-file directory validated against the 2.1.0 JSON schema from schemastore.org (checked
  locally with jsonschema, not added as a dependency).
• Local gate, as in CI: uv sync --locked --extra dev --extra docs, ruff check, ruff format --check, mypy,
  pytest -q -W error::DeprecationWarning: all passed, 770 tests.

🤖 Generated with Claude Code