`sarif`

The sarif tool serializes diagnostics produced by tools implementing the tool_diagnostics_protocol protocol into SARIF 2.1.0 reports:

https://sarifweb.azurewebsites.net/

API documentation

This tool API documentation is available at:

../../apis/library_index.html#sarif

Loading

Load the tool using:

| ?- logtalk_load(sarif(loader)).

Testing

To test this tool, load the tester.lgt file:

| ?- logtalk_load(sarif(tester)).

The test suite validates SARIF generation for single diagnostics producers and explicit aggregate reports, including JSON Schema validation against the SARIF 2.1.0 schema.

Usage

Use the term/4 and generate/4 predicates to generate a report for a single diagnostics producer, target, and options combination. These predicates generate a SARIF document with a single run.

For example:

| ?- sarif::generate(dead_code_scanner, entity(my_object), file('./report.sarif'), []).
true.

Use the term/2 and generate/2 predicates to generate an explicit aggregate report from a list of specifications. Each specification must be a tool_spec(Tool, Target, Options) term and produces a single SARIF run. Runs are emitted in the same order as the specifications list.

For example:

| ?- sarif::generate([
         tool_spec(linter_reporter, all, []),
         tool_spec(dead_code_scanner, entity(my_object), [])
     ], file('./aggregate.sarif')).
true.

Each specification uses the same target and options accepted by the corresponding diagnostics producer. The aggregate API is explicit: the sarif tool does not infer producers or merge options across specifications.

Diagnostics producers

The following tools produce diagnostics compatible with the sarif tool:

dead_code_scanner
lgtdoc
lgtunit
linter_reporter

See the individual tools documentation for details on how to generate diagnostics.

Report visualization

SARIF reports can be visualized using e.g. VSCode extensions or online viewers. SARIF reports are also supported in e.g. GitHub, GitLab, and BitBucket.

sarif