sarif

Static Analysis Results Interoperability Format (SARIF) is an open standard for the output of static analysis tools. Developed and maintained by OASIS, SARIF provides a common JSON-based schema that enables analyzers, editors, and continuous integration systems to exchange results in a uniform format. The goal is interoperability: consumers can ingest results from different tools, correlate them with rules, and present consistent findings to developers.

A SARIF document describes one or more analysis runs. Each run includes a description of the analysis tool (the tool driver) and a collection of results. Each result identifies a finding with a ruleId, a severity level, and one or more locations, which specify the file and the exact region of code affected. Locations reference artifacts (files) and can include a region with start and end lines and columns. Runs may also include logicalLocations to represent code elements such as functions or classes. A separate area can define rules that describe the issues, including identifiers, descriptions, and default configurations.

Format details: SARIF is JSON-based and supports extensibility via properties. It uses top-level version information (for example, version 2.x) and a runs array. File extensions commonly associated with SARIF outputs are .sarif. The format also accommodates metadata about the tool that produced the results, including names, information URIs, and version numbers, helping to contextualize findings.

Adoption and impact: SARIF has been widely adopted by major tooling ecosystems, including code scanning features in platforms like GitHub, Azure DevOps, and various static analyzers and CI pipelines. By standardizing results, SARIF enables developers to aggregate, filter, and triage issues across tools, and to feed automated quality gates and dashboards.