skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse, filter, deduplicate, and aggregate SARIF files from static analysis tools.

Updated Apr 5, 2026
Search Tags:#ci/cd#static analysis#deduplication#jq#codeql#semgrep#SARIF
One-click install
npx skills add https://github.com/marumo333/atrox --skill sarif-parsing-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/static-analysis/skills/sarif-parsing
Command: npx skills add https://github.com/marumo333/atrox --skill sarif-parsing-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Static analysis tools like CodeQL and Semgrep produce large SARIF result files that are hard to read, deduplicate, and compare across runs. This Skill provides proven patterns for extracting actionable findings, merging multi-tool output, and integrating results into CI/CD pipelines. ## Core Features & Use Cases - Query and Filter Findings: Use ready-made jq queries or Python helpers to count results, filter by severity, rule ID, or file path, and extract file/line locations. - Deduplicate and Diff Results: Compute stable fingerprints to track findings across runs, detect regressions, and merge SARIF output from multiple scanners. - CI/CD Integration: Upload SARIF to GitHub code scanning, fail builds on new high-severity issues, and convert results to CSV or HTML reports. - Use Case: After running CodeQL and Semgrep in a pipeline, aggregate both SARIF files, deduplicate overlapping alerts by fingerprint, and fail the build only if new error-level findings appear versus the baseline. ## Quick Start Parse the attached results.sarif file and list all error-level findings with their rule IDs, file paths, and line numbers.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse a SARIF file with jq?▼

Use jq to query SARIF JSON directly, for example jq '[.runs[].results[]] | length' to count findings or jq '.runs[].results[] | select(.level == "error")' to filter errors. The Skill includes 40+ ready-made queries for filtering, grouping, and formatting.

What Python library should I use for SARIF parsing?▼

Use pysarif for a simple object model, sarif-tools for aggregation, diffing, and CLI reporting, or the included sarif_helpers.py which needs no external dependencies. For .NET use the SARIF SDK, and for Go use garif.

How do I deduplicate SARIF findings across multiple runs?▼

Deduplicate using the partialFingerprints or fingerprints fields on each result, falling back to a computed hash of rule ID, filename, line, and message. This keeps identifiers stable even when absolute paths differ between environments.

Can I merge SARIF files from CodeQL and Semgrep?▼

Yes. Combine the runs arrays from each file into a single SARIF object with version 2.1.0, either with jq -s or the merge_sarif_files helper. Each run retains its own tool metadata so results stay attributable.

Why do SARIF fingerprints not match between CI runs?▼

Fingerprints mismatch when file paths differ across environments, tool versions change the fingerprinting algorithm, or code reformatting shifts line numbers. Compute a stable fingerprint from rule ID, filename only, and normalized code snippet instead.

When should I not use SARIF parsing?▼

Do not use SARIF parsing to run scans or write rules; use the CodeQL or Semgrep skills for that. It only processes existing scan output, so it cannot analyze source code directly or triage findings without SARIF input.

Related Skills

Explore More Software Engineering Skills→
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced
rhpdsrhpds

25-security-scanning-vulnerability-research

Analyze codebase vulnerabilities and create Jira security tickets.

Official
Advanced
microsoftmicrosoft
224

validate-sarif

Validate SARIF files against the SARIF 2.1.0 schema and AI profile rules.

Official
Advanced
adamatdevopsadamatdevops
1

sarif-parsing

Parse and normalize OASIS SARIF scan results into filterable security findings.

Community
Intermediate