[GH-ISSUE #6332] [Feature] Export supported analysis findings as SARIF 2.1.0 #3816

New issue

Open

opened 2026-10-31 00:44:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:44:20 +00:00

Owner

Originally created by @jayykernel on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6332

Problem

REA exposes analysis results that could be consumed by code-scanning dashboards and CI systems, but those integrations benefit from a standard interchange format. Consumers otherwise need to write and maintain REA-specific adapters for each result shape.

Desired outcome

Add an optional SARIF 2.1.0 export for analysis operations whose findings can be represented faithfully in SARIF.

Proposed behavior

Export supported findings with stable rule identifiers, available severity, and source locations where the analysis actually provides them.
Preserve links or references to the underlying REA evidence.
Represent unavailable locations and metadata as unavailable; do not fabricate source positions or severity.
Keep existing JSON and CLI/MCP contracts backward compatible.
Document which analysis categories are supported and which cannot yet be mapped.

Acceptance criteria

Representative output validates against the SARIF 2.1.0 schema.
Tests cover findings with complete, partial, and absent location metadata.
Export errors are actionable and do not silently discard unsupported findings.
Existing output formats remain unchanged.

Scope

This is an output-format integration for existing findings. It should not add new analysis capabilities or claim that every REA result is a code-scanning finding.

Originally created by @jayykernel on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6332 ### Problem REA exposes analysis results that could be consumed by code-scanning dashboards and CI systems, but those integrations benefit from a standard interchange format. Consumers otherwise need to write and maintain REA-specific adapters for each result shape. ### Desired outcome Add an optional SARIF 2.1.0 export for analysis operations whose findings can be represented faithfully in SARIF. ### Proposed behavior - Export supported findings with stable rule identifiers, available severity, and source locations where the analysis actually provides them. - Preserve links or references to the underlying REA evidence. - Represent unavailable locations and metadata as unavailable; do not fabricate source positions or severity. - Keep existing JSON and CLI/MCP contracts backward compatible. - Document which analysis categories are supported and which cannot yet be mapped. ### Acceptance criteria - Representative output validates against the SARIF 2.1.0 schema. - Tests cover findings with complete, partial, and absent location metadata. - Export errors are actionable and do not silently discard unsupported findings. - Existing output formats remain unchanged. ### Scope This is an output-format integration for existing findings. It should not add new analysis capabilities or claim that every REA result is a code-scanning finding.

bsakaguchi referenced this issue

2026-10-31 01:10:35 +00:00

[PR #3841] [CLOSED] fix(javascript): attribute service workers only to the navigator global #5940

bsakaguchi referenced this issue

2026-10-31 01:10:59 +00:00

[PR #4010] [MERGED] fix(browser): confirm service-worker cancellation cleanup #5989