SARIF standardization

[Gby56]

Hello hello ! 👋
I'm a maintainer on https://github.com/security-alert/security-alert with @azu and I just discovered your project !
I searched for SARIF and saw the early issues/PRs, and it seems that there was a path for SARIF in experimental...

Is there any chance that SARIF would be supported ? I can start looking into it a bit, I would love to provide support for that even if security-alert already does that, but I think reviewdog has better commenting (exact line?) and interface

[Gby56]

I think I could simply request for a semgrep reviewdog action ?

[Gby56]

Seems like https://github.com/g-wilson/action-semgrep already exists

[haya14busa]

Yes, SARIF support as input/output of reviewdog should be great improvement.
Alternative option would be create a tool to convert RDFormat <=> SARIF (#628).
I just do not have chances/time to support it. Any contributions are welcome :)

I do not understand why action-semgrep is related to this issue.
Looks like it just manually format results instead of consuming nor converting SARIF data.
https://github.com/g-wilson/action-semgrep/blob/17b8bb7e7e42395cac39548fe732df3a816351bc/entrypoint.sh#L10-L13

[jcook-uptycs]

@Gby56 which PR did you find with SARIF support? I can't find it. Also were you able to work on it?

[Ufkoku]

I have found this action https://github.com/HollowMan6/sarif4reviewdog

UPD.
I took this plugin as base and rewrote it to my needs. It was giving a little bit awkward results with my tools. How ever I managed to put sarif reports in review dog)

[AlexOstrovsky]

any update on this?

[irgaly]

Reviewdog v0.15.0 supports SARIF now.

https://github.com/reviewdog/reviewdog/releases/tag/v0.15.0