feat: add review metadata to ufm sarif

[cbill-s]

Description

Add review metadata to ufm sarif

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

---

Note

Low Risk
Changes are additive SARIF fields and test API accessors with broad test coverage; no auth or runtime behavior changes beyond richer export metadata.

Overview
UFM SARIF output now includes policy rule review metadata on ignore suppressions when the applied policy rule was reviewed.

The test API client exposes GetReviewedOn and GetReviewedBy on ignore details (sourced from the policy rule’s reviewed_at / reviewed_by). The UFM SARIF template adds matching reviewedOn and reviewedBy fields in suppression properties, mirroring the existing ignoredOn / ignoredBy shape. Unreviewed ignores do not emit those keys.

OpenAPI models and generated client code are updated for PolicyRuleReviewer and rule review fields; a dedicated presenter test asserts valid JSON and the property bag (including comma handling in the template).

^{Reviewed by Cursor Bugbot for commit c876c48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 12 relevant code sections from 11 files (average relevance: 1.00) pkg/apiclients/mocks/testapi.go (lines 1-225) pkg/apiclients/mocks/issues.go (lines 1-249) internal/local_findings/source/openapi/rest/rest/test.spec.yaml (lines 1528-1728) pkg/utils/ufm/json_test_result.go (lines 1-207) pkg/local_workflows/ignore_workflow/response.go (lines 1-51) pkg/local_workflows/local_models/models.gen.go (2 segments, lines 1187-1386) internal/api/policy/2024-10-15/policy.go (lines 1-228) ... and 4 more file(s)

🤖 Repository instructions applied (from AGENTS.md)