GeezerVison is showing github.com — SARIF file output and reachability filtering by lelia · Pull Request #165 · SocketDev/socket-python-cli
Conversation
lelia
commented
Feb 27, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Summary
Adds two new SARIF output flags and improves Slack bot mode debug logging:
--sarif-file <path> — saves SARIF output to a file for upload to GitHub Code Scanning, SonarQube, VS Code, etc.
--sarif-reachable-only — filters SARIF output to reachable (blocking) findings only (requires --reach)
- Improved
--enable-debug logging in Slack bot mode to surface silent failures when reachability alerts aren't being sent
Changes
--sarif-file: added config field + CLI flag; implies --enable-sarif so users don't need to pass both
--sarif-reachable-only: added config field + CLI flag; exits with a clear error if passed without --reach
output.py: output_console_sarif now writes to the specified filepath in addition to stdout, and pre-filters alerts when --sarif-reachable-only is set
- Testing: added unit tests for SARIF file output, reachability filtering, and
--sarif-reachable-only config validation; added Unit Tests CI workflow; extended e2e tests to validate --sarif-file output and assert reachable-only is a subset of unfiltered results
- Slack debugging: surfaces bot token presence, Slack mode, and reachability facts file path/existence; upgraded silent
return paths in _send_bot_reachability_alerts to error-level logging
Testing
- Confirmed all new unit tests pass both locally and in CI
- Ran
socketcli --sarif-file results.sarif against a representative repo
- Confirmed that a
results.sarif file was output with valid syntax
Preview
Representative preview of what results.sarif output looks like:
{
"$schema": "https://json.schemastore.org/sarif-2.1.0.json",
"version": "2.1.0",
"runs": [
{
"tool": {
"driver": {
"name": "Socket Security",
"informationUri": "https://socket.dev",
"rules": [
{
"id": "lodash==4.17.20 (package.json)",
"name": "Alert lodash==4.17.20 (package.json)",
"shortDescription": {
"text": "Alert lodash==4.17.20 (package.json)"
},
"fullDescription": {
"text": "Prototype Pollution - test"
},
"helpUri": "https://socket.dev/npm/package/lodash/alerts/4.17.20",
"defaultConfiguration": {
"level": "error"
}
}
]
}
},
"results": [
{
"ruleId": "lodash==4.17.20 (package.json)",
"message": {
"text": "<br/><br/>Suggested Action:<br/><br/><a href=\"https://socket.dev/npm/package/lodash/alerts/4.17.20\">https://socket.dev/npm/package/lodash/alerts/4.17.20</a>"
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"uri": "package.json"
},
"region": {
"startLine": 1,
"snippet": {
"text": "package.json not found"
}
}
}
}
]
}
]
}
]
}
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
🚀 Preview package published!
Install with:
pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.76.dev6
Docker image: socketdev/cli:pr-165
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
lelia
changed the title
Add support for writing SARIF results to a file
SARIF file output and reachability filtering
Mar 3, 2026
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|