sarif

README

go-sarif

A minimal, zero-dependency SARIF 2.1.0 emitter for Go static-analysis tools — map findings to results, name your tool, write the document that GitHub Code Scanning / GitLab and other CI systems ingest.

Standard library only. One run, one driver, line-level result regions — the subset most analyzers need to surface findings. For richer SARIF (multiple runs, help URIs, fingerprints, suppressions) use a fuller library such as owenrumney/go-sarif.

Install

go get github.com/richardwooding/go-sarif

Usage

import (
	"os"

	sarif "github.com/richardwooding/go-sarif"
)

func main() {
	_ = sarif.Write(os.Stdout,
		sarif.Tool{
			Name:           "mytool",
			Version:        "1.2.3",
			InformationURI: "https://example.com/mytool",
		},
		[]sarif.Rule{
			{ID: "complexity", Name: "CyclomaticComplexity", Description: "Functions over the complexity ceiling"},
		},
		[]sarif.Result{
			{RuleID: "complexity", Level: "error", Message: "F is too complex", URI: "pkg/a.go", StartLine: 10, EndLine: 42},
			{RuleID: "complexity", Message: "file-level finding", URI: "pkg/b.go"}, // no line → file-level result
		},
	)
}

type Tool struct {
	Name           string // driver name surfaced in Code Scanning (required)
	Version        string // optional; omitted when empty
	InformationURI string // optional; omitted when empty
}

type Result struct {
	RuleID    string
	Level     string // "error" | "warning" | "note"; defaults to "warning"
	Message   string
	URI       string // file path, relative to the repo root
	StartLine int    // <= 0 → file-level result (no region)
	EndLine   int
}

type Rule struct{ ID, Name, Description string }

func Write(w io.Writer, tool Tool, rules []Rule, results []Result) error

Notes:

• Artifact URIs are emitted with forward slashes (RFC 3986), so paths are portable across Windows and POSIX.
• A Result with StartLine <= 0 produces a file-level result (no region) — for findings without a single line (dead code, unused exports, …).
• An empty results slice still writes a valid run.

Extracted from file-search-on.

License

MIT — see LICENSE.

Documentation

Overview

Package sarif renders static-analysis findings as a SARIF 2.1.0 document — the Static Analysis Results Interchange Format that GitHub Code Scanning, GitLab, and other CI systems ingest. Map each finding to a Result, describe its rule in a Rule, identify your analyzer with a Tool, and call Write.

It is deliberately minimal and dependency-free (standard library only): one run, one driver, line-level result regions — the subset most analysis tools need to surface findings in Code Scanning. For richer SARIF (multiple runs, help URIs, fingerprints, suppressions) reach for a fuller library.

Index

• func Write(w io.Writer, tool Tool, rules []Rule, results []Result) error
• type Result
• type Rule
• type Tool

Functions

func Write

func Write(w io.Writer, tool Tool, rules []Rule, results []Result) error

Write encodes results as a SARIF 2.1.0 document to w (pretty-printed). tool identifies the analyzer; rules supply the rule metadata. Passing an empty results slice still emits a valid (empty-results) run.

Types

type Result

type Result struct {
	RuleID    string
	Level     string // "error" | "warning" | "note"; defaults to "warning" when empty
	Message   string
	URI       string // file path, relative to the repo root
	StartLine int
	EndLine   int
}

Result is one finding: a rule id, severity level, human message, and location. A StartLine <= 0 omits the line region, producing a file-level result (e.g. for findings that have no single line).

type Rule

type Rule struct {
	ID          string
	Name        string
	Description string
}

Rule describes one rule id for the SARIF tool.driver.rules table. Each distinct RuleID emitted in results should have a matching Rule.

type Tool

type Tool struct {
	// Name is the driver name surfaced in Code Scanning (e.g. "staticcheck").
	// Required — an empty name produces a technically-valid but unhelpful run.
	Name string
	// Version stamps the driver; omitted from the output when empty.
	Version string
	// InformationURI links to the tool's homepage/docs; omitted when empty.
	InformationURI string
}

Tool identifies the analysis tool in the SARIF driver.