skills.rest
ayehiaa
ayehiaaCOMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse SARIF security scan outputs into deduplicated findings and summaries.

Updated May 2, 2026
Search Tags:#ci/cd#aggregation#deduplication#jq#fingerprinting#sarif#security findings
One-click install
npx skills add https://github.com/ayehiaa/my-travel-assistant --skill sarif-parsing-ayehiaa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/sarif-parsing
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill sarif-parsing-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you understand, consolidate, filter, and deduplicate security scan findings stored in SARIF so you can reliably act on them without being blocked by inconsistent paths and noisy outputs.

Core Features & Use Cases

  • Parse and summarize SARIF findings: Extract rule IDs, severities, messages, and source locations to produce readable reports and statistics.
  • Filter and deduplicate alerts: Remove duplicates and stabilize identification across tool runs using fingerprinting strategies.
  • Aggregate and convert outputs for CI/CD: Combine multiple SARIF files and support reporting workflows (including diffing baseline vs current).
  • Use Case: You run CodeQL and Semgrep in CI and get multiple SARIF outputs with overlapping issues; use this Skill to merge them, keep the most relevant findings, and fail the build only when new high-severity items appear.

Quick Start

Use the sarif-parsing skill to aggregate results.sarif into a deduplicated, severity-filtered set of findings for your CI report.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse and summarize SARIF findings from CodeQL or Semgrep?▼

Parse SARIF files from CodeQL or Semgrep by extracting rule IDs, severities, messages, and source locations to produce readable reports and statistics. The Skill applies defensive parsing and optional-field handling to generate structured summaries.

What's the best way to deduplicate SARIF scan results with inconsistent paths?▼

Deduplicate SARIF scan results using fingerprint-based matching and path normalization. This stabilizes finding identification across multiple tool runs by removing overlapping issues even when file paths are inconsistent between scans.

Can I aggregate multiple SARIF files and filter by severity for CI/CD pipelines?▼

Yes, you can aggregate multiple SARIF files and filter by severity or rule for CI/CD pipelines. Combine outputs from different tools, keep the most relevant findings, and fail the build only when new high-severity items appear compared to the baseline.

How do I convert SARIF output to CSV or JSON for downstream analysis?▼

Convert SARIF output to CSV or JSON using jq- or Python-driven extraction. The Skill processes structured findings into formats suitable for downstream analysis, enabling reporting workflows and baseline diffing.

Does this Skill execute security scans to generate SARIF files?▼

No, this Skill explicitly avoids scan execution. It focuses on processing existing SARIF security scan outputs into structured findings, summaries, and deduplicated results for analysis rather than running the scans themselves.

How do I diff baseline vs current SARIF findings in CI?▼

Diff baseline vs current SARIF findings in CI by aggregating results, applying fingerprint-based matching, and filtering by severity. This supports reporting workflows that fail builds only when new high-severity items appear.

Related Skills

Explore More Data & Analytics Skills→
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
vigoliumvigolium
965

sarif-parsing

Convert SARIF static analysis outputs into deduplicated findings for CI/CD gating.

Official
Intermediate
adamatdevopsadamatdevops
1

sarif-parsing

Parse and normalize OASIS SARIF scan results into filterable security findings.

Community
Intermediate
gounthargounthar

expo-eas-build-expert

Configure and build iOS and Android binaries with Expo EAS Build.

Community
Advanced