sarif-parsing

Use jq for quick CLI queries like counting results or filtering by severity, or Python libraries such as pysarif and sarif-tools for programmatic access. The included sarif_helpers.py module extracts structured findings with rule ID, level, file path, and line numbers.

Deduplicate using the partialFingerprints or fingerprints fields in each result, falling back to a computed hash of rule ID, filename, line, and message. This produces stable identifiers even when tools report different absolute paths.

pysarif provides a full object model for loading and saving SARIF files programmatically, while sarif-tools adds reporting features like summaries, severity histograms, diffing two files, and conversion to CSV or HTML.

Yes, for files over 100MB use the ijson library to stream results incrementally instead of loading the entire JSON into memory. This iterates through runs.item.results.item without exhausting RAM.

Fingerprints mismatch when file paths differ between environments, tool versions change the fingerprinting algorithm, or code reformatting shifts line numbers. Compute custom fingerprints from rule ID, filename only, and normalized code snippets for stability.

No, it only processes existing SARIF output files. Running scans, writing rules, or analyzing source code directly requires the dedicated CodeQL or Semgrep skills instead.