skills.rest
Ayoub-ouederni
Ayoub-ouederniCOMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse, filter, deduplicate, and aggregate SARIF static analysis results from security scanners.

Updated Apr 3, 2026
Search Tags:#ci/cd#static analysis#security scanning#deduplication#codeql#semgrep#sarif
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill sarif-parsing-ayoub-ouederni
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/sarif-parsing
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill sarif-parsing-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pysarif, sarif-tools, ijson, jsonschema, and includes references (resource) components.

What problem does it solve? Static analysis tools like CodeQL and Semgrep produce large SARIF files that are hard to query, deduplicate, and integrate into CI/CD pipelines, making it difficult to track findings across runs and tools. ## Core Features & Use Cases - Query and Filter Findings: Use jq one-liners or Python libraries (pysarif, sarif-tools) to extract findings by severity, rule ID, or file path. - Deduplication and Fingerprinting: Compute stable, environment-independent fingerprints to track findings across runs and detect regressions. - Aggregation and CI/CD Integration: Merge SARIF output from multiple scanners, diff baselines against current scans, and fail builds on new high-severity issues. - Use Case: After running CodeQL and Semgrep in a pipeline, merge both SARIF files, deduplicate overlapping alerts, and fail the build only if new error-level findings appear compared to the baseline. ## Quick Start Parse the attached results.sarif file and list all error-level findings grouped by rule with their file locations.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse SARIF files from CodeQL or Semgrep?▼

Use jq for quick CLI queries like counting findings or filtering by severity, or use Python libraries such as pysarif and sarif-tools for programmatic access to runs, results, and locations. The sarif-tools CLI also provides summary, diff, and format conversion commands.

How do I deduplicate SARIF findings across multiple tools?▼

Deduplicate using the partialFingerprints or fingerprints fields in each result, falling back to a computed hash of rule ID, filename, line number, and message snippet. This produces stable identifiers even when tools report different absolute paths.

What is the difference between pysarif and sarif-tools?▼

pysarif provides a typed object model for loading and saving SARIF files in Python. sarif-tools adds higher-level reporting, histograms, diffing between files, and CLI commands for summary, CSV, and HTML output.

Why do SARIF fingerprints not match across runs?▼

Fingerprints mismatch when file paths differ between environments, tool versions change the fingerprinting algorithm, or code reformatting shifts line numbers. Compute custom fingerprints from rule ID, filename only, and normalized code snippets to improve stability.

How do I handle very large SARIF files in Python?▼

Stream results with the ijson library instead of loading the entire file into memory. Iterating over runs.item.results.item lets you process findings one at a time for files over 100MB.

Can this skill run CodeQL or Semgrep scans?▼

No, this skill only processes existing SARIF output files. Running scans requires the dedicated CodeQL or Semgrep skills, and writing custom rules is also outside its scope.

Related Skills

Explore More Software Engineering Skills→
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced
Rune-kitRune-kit
82

sentinel

Scan code commits for secrets, OWASP top 10 patterns, and dependency vulnerabilities.

Official
Advanced
microsoftmicrosoft
224

validate-sarif

Validate SARIF files against the SARIF 2.1.0 schema and AI profile rules.

Official
Advanced
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced