Process SARIF scan results

Process existing SARIF scan results into filtered findings, deduplicated alerts, baseline comparisons, and reports. SARIF Parsing Best Practices covers SARIF 2.1.0 data from CodeQL, Semgrep, and other static analysis tools. It combines jq queries, Python processing strategies, and reusable helpers for examining runs, rules, messages, file locations, and fingerprints.

Severity resolution is central to the workflow. A result whose kind is other than fail resolves to none. Otherwise, use the result's level when present, then the matched rule's defaultConfiguration.level, then warning. Match rules through a valid ruleIndex or fall back to ruleId. A negative ruleIndex must not select the last rule in an array. CodeQL records severity on rules, so filtering only result.level can miss errors. The Python resolver does not read invocation-level ruleConfigurationOverrides, which can outrank rule defaults.

For duplicate detection, the helpers use supplied fingerprints or partialFingerprints before computing a fallback from the rule ID, normalized full path, line, and message. Keeping directories prevents findings in different files with the same basename from collapsing together. Different absolute workspace prefixes still require repo-relative URIs before comparison across environments. Tool-version changes and reformatted code can also affect matching; an alternative fingerprint example incorporates a normalized code snippet when available.

Aggregation preserves separate runs and their tool metadata. The processing helpers support filtering by severity, file, or rule; severity sorting; grouping; summary counts; CSV-ready rows; and classifying baseline differences as new, fixed, or unchanged. Queries also cover rule descriptions, help URLs, affected files, frequent rules, and minimal or filtered SARIF transformations.

Use this workflow to interpret existing scan output, combine findings from multiple tools, extract particular vulnerabilities, or prepare SARIF data for reporting and CI/CD. It also supports checking whether a change introduced findings relative to a baseline and suppressing known false positives through stable matching.

Use separate CodeQL or Semgrep workflows to run scans or write scanner rules. Direct source-code analysis is outside this workflow. For triage without SARIF input, use variant-analysis or audit skills instead. For very large files, including files above 100MB, streaming with ijson avoids loading the entire document into memory.

Start with SARIF files and, for comparison, baseline and current results. Optional inputs include a schema for validation, file or rule filters, and a base path for resolving relative artifact locations. Validate structure before processing and handle missing optional fields defensively. Path handling removes the file scheme, percent-decodes URIs, and resolves relative locations against a base path; normalized paths are used for fingerprinting.

Python extraction produces Finding objects with resolved severity, message, file path, line and column information, fingerprint, tool and rule names, and the raw result. Output choices include summaries, CSV, HTML reports, tab-separated rows, Markdown tables, merged SARIF, and per-run SARIF containing only error findings. Retaining each result's run context keeps inherited severity associated with the correct rules.

For a quick inventory of the rules triggered in a file:

jq '[.runs[].results[].ruleId] | unique' results.sarif

The query templates extend from basic exploration and severity counts to location extraction, grouping, transformations, and validation checks. Two fixtures cover severity on rules and severity on results, each with exactly one error, providing known answers for checking a severity query before trusting it.

Use jq for quick command-line exploration, pysarif for object-model access, or sarif-tools for aggregation and reporting. The pysarif object model fills a missing result level with warning, so use rule-aware resolution for severity decisions rather than that populated attribute. The reusable Python helpers operate with the standard library alone. Schema-validation examples use ajv-cli or Python jsonschema; the tool-selection options also include the .NET SARIF SDK, sarif-js, garif, and SARIF Validator.

GitHub Actions examples upload results with github/codeql-action/upload-sarif@v3 and fail a severity gate when resolved error findings are present. Baseline comparison supports a separate check for newly introduced issues. These patterns process scanner output after scanning rather than producing the scan itself.