sarif-parsing

The sarif-parsing skill is designed to efficiently process and analyze SARIF (Static Analysis Results Interchange Format) files generated by tools like CodeQL, Semgrep, and other static analysis scanners. It addresses the challenge of managing and interpreting large volumes of static analysis data, enabling users to read scan results, aggregate findings, deduplicate alerts, and convert SARIF output for further use. By focusing exclusively on processing existing scan results rather than performing scans, this skill streamlines the post-analysis workflow and ensures that security and development teams can work effectively with standardized SARIF data.

Key features of this skill include filtering, deduplication, format conversion, and CI/CD integration of SARIF files. It supports detailed exploration of findings, including severity levels, rule IDs, file locations, and fingerprints for stable tracking across multiple analysis runs. Users can leverage command-line tools like jq for quick queries or Python libraries such as pysarif and sarif-tools for more advanced scripting. The skill also guides users in selecting appropriate tools for different programming environments and validating SARIF files according to the OASIS 2.1.0 standard.

This skill is particularly useful for developers, security engineers, and DevOps professionals who need to interpret static analysis results without manually combing through raw scan outputs. Typical use cases include aggregating findings from multiple scanners, deduplicating recurring alerts, integrating security results into automated CI/CD pipelines, and converting SARIF data to alternative formats for reporting or further analysis. By providing structured and repeatable processing capabilities, sarif-parsing enables teams to maintain a clear and consistent understanding of code vulnerabilities and quality issues across projects and analysis runs.