GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — SARIF file output and reachability filtering by lelia · Pull Request #165 · SocketDev/socket-python-cli

Conversation

@lelia

@lelia lelia commented Feb 27, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary

Adds two new SARIF output flags and improves Slack bot mode debug logging:

  • --sarif-file <path> — saves SARIF output to a file for upload to GitHub Code Scanning, SonarQube, VS Code, etc.
  • --sarif-reachable-only — filters SARIF output to reachable (blocking) findings only (requires --reach)
  • Improved --enable-debug logging in Slack bot mode to surface silent failures when reachability alerts aren't being sent

Changes

  • --sarif-file: added config field + CLI flag; implies --enable-sarif so users don't need to pass both
  • --sarif-reachable-only: added config field + CLI flag; exits with a clear error if passed without --reach
  • output.py: output_console_sarif now writes to the specified filepath in addition to stdout, and pre-filters alerts when --sarif-reachable-only is set
  • Testing: added unit tests for SARIF file output, reachability filtering, and --sarif-reachable-only config validation; added Unit Tests CI workflow; extended e2e tests to validate --sarif-file output and assert reachable-only is a subset of unfiltered results
  • Slack debugging: surfaces bot token presence, Slack mode, and reachability facts file path/existence; upgraded silent return paths in _send_bot_reachability_alerts to error-level logging

Testing

  • Confirmed all new unit tests pass both locally and in CI
  • Ran socketcli --sarif-file results.sarif against a representative repo
  • Confirmed that a results.sarif file was output with valid syntax

Preview

Representative preview of what results.sarif output looks like:

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Socket Security",
          "informationUri": "https://socket.dev",
          "rules": [
            {
              "id": "lodash==4.17.20 (package.json)",
              "name": "Alert lodash==4.17.20 (package.json)",
              "shortDescription": {
                "text": "Alert lodash==4.17.20 (package.json)"
              },
              "fullDescription": {
                "text": "Prototype Pollution - test"
              },
              "helpUri": "https://socket.dev/npm/package/lodash/alerts/4.17.20",
              "defaultConfiguration": {
                "level": "error"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "lodash==4.17.20 (package.json)",
          "message": {
            "text": "<br/><br/>Suggested Action:<br/><br/><a href=\"https://socket.dev/npm/package/lodash/alerts/4.17.20\">https://socket.dev/npm/package/lodash/alerts/4.17.20</a>"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "package.json"
                },
                "region": {
                  "startLine": 1,
                  "snippet": {
                    "text": "package.json not found"
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
lelia added 5 commits February 26, 2026 19:53
@lelia
Add support for SARIF file output
c81fe57
Signed-off-by: lelia <[email protected]>
@lelia
Ignore SARIF results
677b851
Signed-off-by: lelia <[email protected]>
@lelia
Add test for new SARIF output functionality
e329f32
Signed-off-by: lelia <[email protected]>
@lelia
Document new CLI output flag and clarify intended usage
bf3a7cf
Signed-off-by: lelia <[email protected]>
@lelia
Bump version to prep for release
fa64a8f
Signed-off-by: lelia <[email protected]>
@lelia
lelia requested a review from a team as a code owner February 27, 2026 01:03
@github-actions

github-actions Bot commented Feb 27, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.76.dev6

Docker image: socketdev/cli:pr-165

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lelia added 12 commits March 3, 2026 14:25
@lelia
Merge branch 'main' into lelia/fix-sarif-output
4c73af1
@lelia
Bump version to account for new release
03dc039
Signed-off-by: lelia <[email protected]>
@lelia
Add workflow for running unittests
8c24196
Signed-off-by: lelia <[email protected]>
@lelia
Tweak workflow name
71043a3
Signed-off-by: lelia <[email protected]>
@lelia
Install dev dependencies for testing
d12faf6
Signed-off-by: lelia <[email protected]>
@lelia
Update lockfile
702bd4c
Signed-off-by: lelia <[email protected]>
@lelia
Add configurable option for reachabilty filtering with SARIF
1ce447f
Signed-off-by: lelia <[email protected]>
@lelia
Implement reachabilty logic for SARIF output
2b0c0aa
Signed-off-by: lelia <[email protected]>
@lelia
Add unittests to cover new reachability filtering functionality
4376ca2
Signed-off-by: lelia <[email protected]>
@lelia
Update README to document new filtering options and required use of -…
3fe77d7
…-reach flag

Signed-off-by: lelia <[email protected]>
@lelia
Update e2e tests to include SARIF workflow
b15eea8
Signed-off-by: lelia <[email protected]>
@lelia
Impove Slack bot mode debug logging to surface failures
9b65eb9
Signed-off-by: lelia <[email protected]>
@socket-security-staging

socket-security-staging Bot commented Mar 3, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedpypi/​socketdev@​3.0.31 ⏵ 3.0.3298 +1100100100100

View full report

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@socket-security

socket-security Bot commented Mar 3, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedpypi/​socketdev@​3.0.31 ⏵ 3.0.3298 +1100100100100

View full report

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lelia added 2 commits March 3, 2026 16:38
@lelia
Skip gitlab tests that pass incorrect mock client to constructor
ddf7ede
Signed-off-by: lelia <[email protected]>
@lelia
Update old constructor to use current Mock(spec=CliConfig) pattern, p…
2b9e536
…lus other test fixes

Signed-off-by: lelia <[email protected]>
@lelia lelia changed the title Add support for writing SARIF results to a file SARIF file output and reachability filtering Mar 3, 2026
@lelia lelia assigned Douglas (dacoburn) Mar 3, 2026
dacoburn
Douglas (dacoburn) approved these changes Mar 4, 2026
View reviewed changes
@dacoburn
Douglas (dacoburn) merged commit b8b49f5 into main Mar 4, 2026
10 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@dacoburn
Douglas (dacoburn) deleted the lelia/fix-sarif-output branch March 4, 2026 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dacoburn Douglas (dacoburn) dacoburn approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@dacoburn Douglas (dacoburn)

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@lelia @dacoburn
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.