sarifkit
Pure MoonBit SARIF 2.1.0 report builder, validator and merger
sarif
static-analysis
diagnostics
ci
security
moon add Derk2006/sarifkit@0.1.1
Download zipAuthor
Version
0.1.1
License
MIT
Repository
Last updated
7 hours ago
Downloads
8
README#Derk2006/sarifkit
Derk2006/sarifkit 是一个 MoonBit 原生 SARIF 2.1.0 报告工具库，用于静态分析、lint、安全扫描、包质量检查和 CI 诊断结果的结构化输出。
SARIF 是 GitHub Code Scanning、静态分析器和安全工具常用的交换格式。本项目提供报告构造、JSON 输出、轻量解析、校验诊断、统计摘要、结果筛选、日志合并、baseline 标记、GitHub annotation 转换、规则模板目录和 SARIF 字段目录，便于 MoonBit 生态中的开发工具直接生成可上传、可审计、可维护的诊断报告。
#安装
moon add Derk2006/sarifkit@0.1.1Mooncakes 包名：
Derk2006/sarifkit#快速示例
test {
let log = @sarifkit.quick_log(
"moonlint",
"MB001",
"debug print should be removed",
"src/main.mbt",
12,
column=3,
)
inspect(log.summary(), content="runs=1 rules=1 results=1 errors=0 warnings=1 notes=0 artifacts=1")
}#本地运行
moon check
moon build
moon test
moon doc
moon run cmd/main
moon package#核心能力
- SARIF 2.1.0 数据模型：SarifLog、SarifRun、SarifResult、SarifRule、Region、Artifact
- 构造器：SarifBuilder、quick_log、add_fingerprinted_result
- JSON：SarifLog::to_json_string、SarifLog::from_json_string
- 校验：validate、validate_with_policy、SarifValidationPolicy
- 统计：stats、rule_summaries、summary、markdown_report
- 筛选：filter_by_level、filter_by_rule、filter_by_uri、limit_results_per_run
- 合并：merge_with、merge_logs、merge_runs_by_tool
- baseline：mark_against、baseline_summary
- CI 注解：github_annotations、github_annotation_commands
- 指纹：stable_hash、stable_result_key、with_stable_fingerprints
- 目录：catalog_rules、catalog_lookup、schema_fields、schema_lookup
#适用场景
- MoonBit lint、格式检查、包质量扫描输出 SARIF
- CI 中把错误、警告和说明转换成 GitHub workflow annotation
- 多个工具的诊断结果合并为一个报告
- 发布前比较当前扫描结果和历史 baseline
- 将包元数据、许可证、README、示例和测试检查结果结构化记录
- 为开发工具 UI 提供 SARIF 字段说明和规则模板
#生态定位
本项目定位为可被其他 MoonBit 开发工具复用的 SARIF 报告层，不是单一 SARIF 类型定义，也不是某个具体扫描工具的内置输出模块。项目重点覆盖从诊断结果到可上传 SARIF 报告的完整链路，包括构造、轻量解析、校验策略、统计、筛选、合并、baseline、GitHub annotation、规则模板目录和字段目录。
#支持范围
- 单文件 SARIF 2.1.0 日志
- 单 run 与多 run 构造、合并和筛选
- tool.driver、rules、results、locations、artifacts、invocations、automationDetails
- result level、kind、baselineState、partialFingerprints、properties
- 基础 JSON 编码和核心字段解码
- 常见规则模板与 SARIF schema 字段目录
#暂不支持范围
- 完整 SARIF 官方 JSON Schema 的全字段强校验
- 外部文件读取、网络上传或平台 API 调用
- codeFlows、threadFlows、graphs、taxonomies 的完整建模
- SARIF 压缩、签名和大型日志流式编码
#开源与合规
本项目采用 MIT 许可证。项目为原创 MoonBit 实现，不移植第三方源代码，不包含来源不明素材或私有代码。SARIF 相关字段和语义依据公开格式约定实现，核心功能全部使用 MoonBit 编写。
#工程记录
- 项目申报书：SUBMISSION.md
- 设计说明：docs/DESIGN.md
- Mooncakes 非重复调研：docs/MOONCAKES_RESEARCH.md
- 工单记录：docs/WORKLOG.md
- 测试记录：docs/TEST_RECORD.md
- 版本发布记录：docs/RELEASE_NOTES.md
- 更新日志：CHANGELOG.md
#Artifact
pub struct Artifact {
location : ArtifactLocation
length : Int?
mime_type : String?
roles : Array[String]
} derive(Eq, ToJson, Debug)#ArtifactLocation
URI location for an artifact. uri_base_id mirrors SARIF's uriBaseId
field and is useful when a CI runner wants relative paths anchored to a
checkout root.
#ArtifactLocation::ArtifactLocation
fn ArtifactLocation::ArtifactLocation(uri : StringView, uri_base_id? : String, index? : Int) -> ArtifactLocation#Fingerprint
#Fingerprint::Fingerprint
#GithubAnnotation
#GithubAnnotation::GithubAnnotation
fn GithubAnnotation::GithubAnnotation(path : StringView, start_line : Int, end_line : Int, annotation_level : StringView, message : StringView, title? : String) -> GithubAnnotation#GithubAnnotation::workflow_command
#PhysicalLocation
pub struct PhysicalLocation {
artifact_location : ArtifactLocation
region : Region?
} derive(Eq, ToJson, Debug)#PhysicalLocation::PhysicalLocation
fn PhysicalLocation::PhysicalLocation(artifact_location : ArtifactLocation, region? : Region) -> PhysicalLocation#PhysicalLocation::from_path
#Region
Region in an artifact. SARIF positions are one-based. End positions are
optional because many diagnostics naturally refer to a single point.
#Region::Region
#Region::single_line
#RuleSummary
#SarifBuilder
pub struct SarifBuilder {
tool_name : String
tool_version : String?
information_uri : String?
rules : Array[SarifRule]
results : Array[SarifResult]
artifacts : Array[Artifact]
invocations : Array[SarifInvocation]
automation_id : String?
} derive(Debug)Mutable builder for constructing a single-run SARIF log.
#SarifBuilder::SarifBuilder
fn SarifBuilder::SarifBuilder(tool_name : StringView, tool_version? : String, information_uri? : String) -> SarifBuilder#SarifBuilder::add_artifact
fn SarifBuilder::add_artifact(self : SarifBuilder, uri : StringView, length? : Int, mime_type? : String, roles? : ArrayView[String]) -> Int#SarifBuilder::add_fingerprinted_result
fn SarifBuilder::add_fingerprinted_result(self : SarifBuilder, rule_id : StringView, message : StringView, uri : StringView, line : Int, column? : Int, level? : String) -> Int#SarifBuilder::add_invocation
fn SarifBuilder::add_invocation(self : SarifBuilder, command_line? : String, working_directory? : String, execution_successful? : Bool) -> Unit#SarifBuilder::add_result
fn SarifBuilder::add_result(self : SarifBuilder, rule_id : StringView, message : StringView, level? : String, uri? : String, line? : Int, column? : Int) -> Int#SarifBuilder::add_result_object
#SarifBuilder::add_rule
fn SarifBuilder::add_rule(self : SarifBuilder, id : StringView, name? : String, short_description? : String, default_level? : String, tags? : ArrayView[String]) -> Int#SarifBuilder::add_rule_object
#SarifBuilder::set_automation_id
#SarifBuilder::set_information_uri
#SarifBuilder::set_tool_version
#SarifDiagnostic
#SarifDiagnostic::SarifDiagnostic
fn SarifDiagnostic::SarifDiagnostic(severity : StringView, code : StringView, path : StringView, message : StringView) -> SarifDiagnostic#SarifError
#SarifFieldDescriptor
SARIF schema field descriptors used by documentation, validation reports
and tool UIs that need to explain which part of a SARIF log is being
inspected. This is a compact MoonBit-native reference table, not a full
replacement for the SARIF specification.
#SarifFieldDescriptor::SarifFieldDescriptor
fn SarifFieldDescriptor::SarifFieldDescriptor(object_name : StringView, field_name : StringView, required? : Bool, value_kind? : String, note? : String) -> SarifFieldDescriptor#SarifInvocation
#SarifInvocation::SarifInvocation
fn SarifInvocation::SarifInvocation(command_line? : String, working_directory? : String, execution_successful? : Bool) -> SarifInvocation#SarifLocation
pub struct SarifLocation {
physical_location : PhysicalLocation
message : SarifMessage?
logical_name : String?
} derive(Eq, ToJson, Debug)#SarifLocation::SarifLocation
fn SarifLocation::SarifLocation(physical_location : PhysicalLocation, message? : SarifMessage, logical_name? : String) -> SarifLocation#SarifLocation::from_path
fn SarifLocation::from_path(uri : StringView, line : Int, column? : Int, message? : String) -> SarifLocation#SarifLog
#SarifLog::SarifLog
#SarifLog::filter_by_level
#SarifLog::filter_by_rule
#SarifLog::filter_by_uri
#SarifLog::filter_results
#SarifLog::from_json_string
#SarifLog::github_annotation_commands
#SarifLog::github_annotations
#SarifLog::limit_results_per_run
#SarifLog::mark_against
#SarifLog::to_json_string
#SarifLog::validate_with_policy
fn SarifLog::validate_with_policy(self : SarifLog, policy : SarifValidationPolicy) -> Array[SarifDiagnostic]#SarifLog::with_stable_fingerprints
#SarifMessage
Text carried by SARIF objects. SARIF allows both plain text and Markdown;
the plain text form is required in most places and is kept as the stable
fallback for tools that do not render Markdown.
#SarifMessage::SarifMessage
#SarifProperty
#SarifProperty::SarifProperty
#SarifResult
pub struct SarifResult {
rule_id : String
level : String
kind : String
message : SarifMessage
locations : Array[SarifLocation]
fingerprints : Array[Fingerprint]
properties : Array[SarifProperty]
baseline_state : String?
} derive(Eq, ToJson, Debug)#SarifResult::SarifResult
fn SarifResult::SarifResult(rule_id : StringView, message : StringView, level? : String, kind? : String, locations? : ArrayView[SarifLocation], fingerprints? : ArrayView[Fingerprint], properties? : ArrayView[SarifProperty], baseline_state? : String) -> SarifResult#SarifResult::fingerprint_value
#SarifResult::property_value
#SarifResult::to_github_annotation
#SarifResult::with_fingerprint
fn SarifResult::with_fingerprint(self : SarifResult, key : StringView, value : StringView) -> SarifResult#SarifResult::with_stable_fingerprint
#SarifRule
pub struct SarifRule {
id : String
name : String?
short_description : SarifMessage?
full_description : SarifMessage?
default_level : String
help_uri : String?
tags : Array[String]
} derive(Eq, ToJson, Debug)#SarifRun
pub struct SarifRun {
tool : ToolDriver
results : Array[SarifResult]
artifacts : Array[Artifact]
invocations : Array[SarifInvocation]
automation_id : String?
} derive(Eq, ToJson, Debug)#SarifRun::SarifRun
fn SarifRun::SarifRun(tool : ToolDriver, results? : ArrayView[SarifResult], artifacts? : ArrayView[Artifact], invocations? : ArrayView[SarifInvocation], automation_id? : String) -> SarifRun#SarifRun::filter_by_level
#SarifRun::filter_by_rule
#SarifRun::filter_by_uri
#SarifRun::filter_results
#SarifRun::github_annotations
#SarifRun::mark_against
#SarifRun::validate_with_policy
fn SarifRun::validate_with_policy(self : SarifRun, policy : SarifValidationPolicy) -> Array[SarifDiagnostic]#SarifRun::with_stable_fingerprints
#SarifStats
#SarifStats::has_blocking_findings
#SarifValidationPolicy
#SarifValidationPolicy::SarifValidationPolicy
fn SarifValidationPolicy::SarifValidationPolicy(require_results_have_locations? : Bool, require_declared_rules? : Bool, require_artifacts_for_locations? : Bool, min_level? : String, max_results_per_run? : Int) -> SarifValidationPolicy#ToolDriver
#ToolDriver::ToolDriver
fn ToolDriver::ToolDriver(name : StringView, version? : String, information_uri? : String, rules? : ArrayView[SarifRule]) -> ToolDriver#find_rule_by_id
#mark_baseline
fn mark_baseline(current : ArrayView[SarifResult], previous : ArrayView[SarifResult]) -> Array[SarifResult]#quick_log
fn quick_log(tool_name : StringView, rule_id : StringView, message : StringView, uri : StringView, line : Int, column? : Int, level? : String) -> SarifLog#schema_fields_for
#schema_lookup
#schema_required_fields_for
#stable_result_key
fn stable_result_key(rule_id : StringView, message : StringView, uri : StringView, line : Int, column : Int) -> StringPure MoonBit SARIF 2.1.0 report builder, validator and merger
sarifstatic-analysisdiagnosticscisecurity
0.1.1
MIT
Updated 7 hours ago
8 downloads