sarif-sdk
Emit, validate, and publish SARIF security findings
All Skills in This Repository (4)
Pure Emerald Level Indicators
microsoftvalidate-sarif
Validate SARIF files against the SARIF 2.1.0 schema and AI profile rules.
microsoftpublish-to-ghas
Upload finalized SARIF files to GitHub Advanced Security via Sarif.Multitool.
microsoftemit-sarif
Serialize AI-generated security findings as SARIF v2.1.0 logs.
microsoftpublish-to-ghazdo
Publish finalized SARIF files to GitHub Advanced Security for Azure DevOps.
Frequently Asked Questions
FAQPage SchemaHow to install sarif-sdk?▼
Run `npx skills add microsoft/sarif-sdk --all -g -y` in your terminal to install all skills in this suite globally.
What is SARIF used for?▼
SARIF is a standard JSON format for sharing static analysis and security scan results between tools, dashboards, and code scanning platforms.
How to validate a SARIF file?▼
The validate-sarif skill runs Sarif.Multitool against your file, checking both the base SARIF 2.1.0 schema and the AI findings profile rules in one pass.
How to upload SARIF to GitHub code scanning?▼
The publish-to-ghas skill uploads a finalized SARIF file to GitHub Advanced Security, deriving the repository, commit, and branch automatically from the file's provenance.
Does sarif-sdk work with Azure DevOps?▼
Yes. The publish-to-ghazdo skill uploads finalized SARIF files to GitHub Advanced Security for Azure DevOps, with offline validation to catch ingestion errors before publishing.
Related Repositories in Software Engineering
View All in Software Engineering→
openclawopenclaw
Run a personal AI assistant across your devices and chat apps
obrasuperpowers
Gives coding agents a disciplined workflow from idea to merged code
facebookreact
AI agent skills for building, testing, and porting React core