Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Sarif reporting format #594

Open
halkeye opened this issue Oct 15, 2022 · 7 comments · May be fixed by #1047
Open

Support Sarif reporting format #594

halkeye opened this issue Oct 15, 2022 · 7 comments · May be fixed by #1047
Labels
enhancement Improve the expected

Comments

@halkeye
Copy link
Contributor

halkeye commented Oct 15, 2022

OASIS Static Analysis Results Interchange Format is a newish standardization format for analysis tools.

It would be great if typos can support outputting that format.

Looks like there is already libraries to generate the format so it shouldn't be a hard lift.

@halkeye
Copy link
Contributor Author

halkeye commented Oct 15, 2022

I can make the attempt if desired, but I learned with the github actions formatter it might not be desirable so wanted to ask/talk about it first.

@epage
Copy link
Collaborator

epage commented Oct 15, 2022

Following the initial link, I only saw references to it being a draft and not finalized. Though other documents I later found refer to it as approved with no draft mention.

The docs for the Rust API seem to caution use of the lib itself.

Also, any idea on how adoption of this has been so far?

@halkeye
Copy link
Contributor Author

halkeye commented Oct 16, 2022

Also, any idea on how adoption of this has been so far?

I learned about it playing with codeql (eslint template) on github actions. They recommend https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github

So it feels like microsoft and github are both pushing for it.

@epage
Copy link
Collaborator

epage commented Oct 16, 2022

At times, it felt like I was reading about a security feature and at times it felt more broad.

The alert tracking sounds nice, like it might offer some of the static analysis benefits of a tool I managed at a prior job that allowed adding new static analysis without being buried under the weight of the backlog.

Overall, I would be in favor of this depending on the level of maturity of library support for it. Depending on how this evolves, we'd need to be prepared for how we expose versioning. Would we just do serif, serif-2, serif-2.1 or something else?

@epage epage added the enhancement Improve the expected label Oct 16, 2022
@andersk
Copy link

andersk commented Jan 2, 2023

Since this is the typos project, I feel compelled to note: it’s SARIF, not SERIF. 😛

@epage
Copy link
Collaborator

epage commented Jan 3, 2023

When coming up with a name for the project, I was tempted to make the name include a typo but figured that'd be too aggravating, either for people typing the command name (and spelling it correctly) or when running the command.

@Zxilly
Copy link

Zxilly commented Jun 19, 2024

I was wondering if anyone is working on this issue? I would like to add this support, but I am not a professional rust developer, so the code quality may be poor.

@Zxilly Zxilly linked a pull request Jun 28, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Improve the expected
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants