Repository navigation
SARIF output for secfoo findings export #46
Description
Problem: secfoo findings export only writes JSON Lines. SARIF 2.1.0 is the format GitHub code scanning, GitLab and most IDEs import, so supporting it would show secfoo findings in the Security tab.
Proposal: add --format jsonl|sarif (default jsonl, so existing behavior doesn't change). Map severity to SARIF level/security-severity, the CWE to rules[].properties.tags, and the file/line to locations.
Where to look: findings export in src/secfoo/cli.py, src/secfoo/report/.
Done when: the output validates against the SARIF 2.1.0 schema in a test, and there's a short example in docs/REFERENCE.md of uploading it with github/codeql-action/upload-sarif.
Activity