sarif-parsing

Use jq for quick CLI queries like extracting rule IDs and severity counts, or Python libraries such as pysarif and sarif-tools for programmatic access. The sarif-tools CLI also supports summary, diff, and CSV/HTML conversion commands.

Deduplicate using the partialFingerprints or fingerprints fields in each result, falling back to a computed hash of rule ID, filename, line, and message. Merge the runs arrays from each file first, then remove results with duplicate fingerprints.

pysarif provides a typed object model for loading and saving SARIF files in Python. sarif-tools adds higher-level reporting, severity histograms, file diffing, and a CLI for summary, filtering, and format conversion.

Stream results with the ijson library instead of loading the entire file into memory. Iterate over the runs.item.results.item path to process findings one at a time with constant memory usage.

Fingerprints change when file paths differ between environments, tool versions update their hashing algorithm, or code reformatting shifts line numbers. Compute stable fingerprints from rule ID, filename only, and normalized code snippets.

No, it only processes existing SARIF output files. Running scans, writing rules, or analyzing source code directly requires the dedicated CodeQL or Semgrep skills instead.