Support SARIF

The Static Analysis Results Interchange Format (SARIF) is an industry standard format for the output of static analysis tools ^1.

This page contains tools that support SARIF format and thus can be easily integrated in CI.

Supported

• Github, Documentation
• Clang Analyzer, pull-request
• Clang with diagnostic messages, https://lists.llvm.org/pipermail/cfe-dev/2021-March/067907.html
• Clang-Tidy
  • Adding SARIF result format support for clang-tidy
  • ZedThree/clang-tidy-review - Github Action that creates a pull-request review based on the warnings from clang-tidy.
  • clang-tidy-sarif - Rust crate provides a command line tool to convert clang-tidy diagnostic output into SARIF.
• cfn-lint, pull-request
• eslint, via eslint-formatter-sarif
• JetBrains Qodana, Documentation
• Svace, Documentation
• PVS Studio, Documentation
• semgrep, Documentation
• OSS Fuzz, Documentation
• CodeQL, Documentation

In progress

• GitLab, Issue#118496

Unsupported

• Codespell, Issue#1455
• CTest, Issue#25953

Misc

• ReviewDog converts popular output formats to SARIF.
• SARIF Tools - is set of command line tools and Python library for working with SARIF files.