Use proper finding IDs for sonar and semgrep SARIF #2849

	name: Codemod Pygoat

	on:
	push:
	branches:
	- main
	- develop
	pull_request:
	branches:
	- main
	- develop
	merge_group:

	concurrency:
	group: (${{ github.workflow }}-${{ github.event.inputs.branch \|\| github.event.pull_request.head.ref }})
	cancel-in-progress: true

	jobs:
	test:
	name: Run Codemod on Pygoat
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	steps:
	- name: Check out codemodder
	uses: actions/checkout@v4
	- name: Set Up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: 'pip'
	- name: Install Codemodder Package
	run: pip install .
	- name: Install Test Dependencies
	run: pip install ".[test]"
	- name: Check out Pygoat
	uses: actions/checkout@v4
	with:
	repository: pixee/pygoat
	path: pygoat
	- name: Run Codemodder
	run: codemodder --dry-run --output output.codetf pygoat
	- name: Check PyGoat Findings
	run: make pygoat-test

Provide feedback