sarif-parsing

To parse SARIF files from multiple static analysis tools in CI/CD, provide the generated files for aggregation, filtering, and deduplication. This standardizes findings across tools like CodeQL and Semgrep into a CI/CD friendly report.

SARIF deduplication filters and removes duplicate code scanning findings across multiple runs and tools. It standardizes the data so security teams can aggregate results without reviewing redundant vulnerabilities.

Yes, you can convert SARIF to other formats like CSV or HTML for CI/CD reporting. The parsing process transforms and filters the standardized findings into these formats for automated workflow integration.

Yes, you need external trigger tools like CodeQL or Semgrep to generate the SARIF files. The parser processes and harmonizes these existing outputs but does not execute the code scans itself.

A key limitation of parsing SARIF outputs is that it cannot execute scans itself; it relies entirely on external trigger tools like CodeQL or Semgrep to generate the input files for processing and standardization.