Registry / testing / sarif-tools

sarif-tools

JSON →
library3.0.5pypypi✓ verified 22d ago

sarif-tools is a Python library and command-line interface for working with Static Analysis Results Interchange Format (SARIF) files. It provides utilities for summarizing, comparing, transforming, and extracting information from SARIF reports. The current version is 3.0.5, with an active development cadence focusing on bug fixes and occasional breaking changes in major versions.

pip install sarif-tools
INSTALL
IMPORT
SIG · SARIF-TOOLS
S
sarif-tools
testingpythonv3.0.5
Install
9.1s avg
Import
Disk
201MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v3.0.5 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.000s · 197.4MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 9.1s · import 0.000s · 190MB
201MB installed
● package 201MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

SarifFileSet
import sarif
from sarif import SarifFileSet

This quickstart demonstrates how to load a SARIF file using `SarifFileSet`, access its issue report via `get_report()`, and then retrieve issues filtered by severity using the v3.0.0+ API. It creates a temporary dummy SARIF file for the example.

import os import json from sarif_tools.sarif_file_set import SarifFileSet # Create a dummy SARIF file for demonstration dummy_sarif_content = { "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Dummy Tool" } }, "results": [ { "message": {"text": "A dummy error was found."}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "dummy_code.py"}, "region": {"startLine": 1, "startColumn": 1} } } ], "level": "error", "ruleId": "DUMMY001" }, { "message": {"text": "A dummy warning was found."}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "dummy_code.py"}, "region": {"startLine": 5, "startColumn": 10} } } ], "level": "warning", "ruleId": "DUMMY002" } ] } ] } dummy_sarif_path = "dummy_report.sarif" with open(dummy_sarif_path, "w", encoding="utf-8") as f: json.dump(dummy_sarif_content, f, indent=2) try: # Load a SARIF file set sarif_set = SarifFileSet(dummy_sarif_path) # Get the issue report (introduced in v3.0.0) report = sarif_set.get_report() # Get issues for a specific severity error_issues = report.get_issues_for_severity('error') print(f"Found {len(error_issues)} error(s):") for issue in error_issues: print(f" - {issue.message} at {issue.location_string}") warning_issues = report.get_issues_for_severity('warning') print(f"\nFound {len(warning_issues)} warning(s):") for issue in warning_issues: print(f" - {issue.message} at {issue.location_string}") finally: # Clean up the dummy file if os.path.exists(dummy_sarif_path): os.remove(dummy_sarif_path)
sarif --version
Debug
Known issues
breakingThe Python API for `SarifFileSet` changed significantly in v3.0.0. Direct methods like `get_result_count_by_severity()` and `get_records_grouped_by_severity()` were removed. You must now call `sarif_set.get_report()` to get an `IssueReport` object, which exposes the new methods for issue grouping and sorting.
fix
Update your code to call `sarif_set.get_report()` and then use methods on the returned `IssueReport` object (e.g., `report.get_issue_count_for_severity(severity)` or `report.get_issues_for_severity(severity)`).
affects: >=3.0.0
breakingIn v2.0.0, the CSV output format for the CLI (`sarif csv`) changed: 'Code' and 'Description' are now separate columns, previously combined. Also, the `--blame-filter` argument was replaced by a more general `--filter` which uses a new YAML-based format.
fix
If parsing CSV output, update your parsing logic for the new column structure. For filtering, replace `--blame-filter` with `--filter` and adapt your filter definitions to the new YAML format. Use the `upgrade-filter` command to assist with conversion.
affects: >=2.0.0
gotchaImmediate minor releases after a major version (e.g., v3.0.1 after v3.0.0) have historically contained critical bug fixes for commands like `sarif diff`.
fix
Always use the latest patch release of a major version. For example, if upgrading to v3, use v3.0.5 or later, not v3.0.0.
affects: ~3.0.0
gotchaWhen processing SARIF files that may contain non-UTF-8 encoded strings, older versions of `sarif-tools` could crash with `UnicodeDecodeError` when using commands like `sarif blame`.
fix
Upgrade to `sarif-tools` v3.0.5 or newer to benefit from fixes handling invalid UTF-8.
affects: <3.0.5
gotchaThe `--check` command previously had a crash issue in certain scenarios.
fix
Upgrade to `sarif-tools` v3.0.4 or newer to resolve crashes with the `--check` command.
affects: <3.0.4
Upgrade
Version history
3.0.5latest on PyPI · released Jul 17, 2025
Audit
Dependencies

No dependency data recorded yet.

Agent activity
25 hits · last 30 days
node
22
OpenAI (training)
1
Resources
sarif-tools — pip install sarif-tools · libregistry