sarif-parsing

To parse SARIF static analysis outputs, this Skill extracts rule IDs, severities, and locations, then leverages SARIF fingerprints including partialFingerprints to aggregate and deduplicate findings across multiple runs or tools like CodeQL and Semgrep.

The best way to extract actionable fields from a SARIF report is by applying defensive SARIF field access and path normalization, which securely pulls rule IDs, severities, messages, and file/line locations to support reporting and triage workflows.

Yes, you can use SARIF parsing to integrate into CI/CD by preparing structured outputs and applying patterns like fail-on-new-issues, allowing the pipeline to fail when new high-severity issues appear without running any new vulnerability scans.

Yes, SARIF parsing supports vulnerability reporting from both CodeQL and Semgrep, working by reading, filtering, and transforming their SARIF outputs into structured, deduplicated findings for secure reporting.

The main limitation is that this SARIF parsing approach does not run any new vulnerability scans; it strictly requires existing SARIF outputs and relies on stable fingerprint handling and defensive field access to deduplicate and transform findings.

To normalize file paths when aggregating findings from multiple SARIF runs, the parsing mechanism applies path normalization alongside defensive SARIF field access, ensuring stable fingerprint handling for accurate deduplication.