microsoft/sarif-sdk

View on GitHub

.NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https://github.com/oasis-tcs/sarif-spec)

Stars: 226
Forks: 108
Open beginner issues: 1
Indexed issues: 426
Avg merge: 3d 8h
Merged PRs (30d): 6

Dominant language: C#
License: No license data
Last GitHub push: Sep 10, 2026
Latest indexed: Sep 19, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

426 open issues indexed

Port authorizedHosts (self-hosted VCS attestation) to C# VcpPortableRoot Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

microsoft/sarif-sdk#3131 · Opened Jul 7, 2026
Adopt Microsoft.Json.* 2.3.0 and add missing UriConverter attributes to Uri properties Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

microsoft/sarif-sdk#3121 · Opened Jul 1, 2026
Intermittent test failure in Test.UnitTests.Sarif.Multitool.Library under full-suite runs Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

microsoft/sarif-sdk#3092 · Opened Jun 23, 2026
TS get-schema emit-finalize throws despite bundled ai-log.schema.json (.NET serves it) — incomplete TS port of #2970/#3077 in 5.3.0 Open

bug javascript

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

microsoft/sarif-sdk#3083 · Opened Jun 22, 2026
publish-to-ghas skill: document that a gh CLI OAuth token (repo scope) works without a PAT (PAT-restricted orgs) Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

microsoft/sarif-sdk#3081 · Opened Jun 21, 2026
CweTaxonomyEnricher: CWE descriptors get a one-sentence fullDescription (MITRE short Description), no markdown, and often no shortDescription Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/sarif-sdk#3078 · Opened Jun 21, 2026
emit-finalize: deprecated CWEs in CweSecuritySeverity produce nameless rule descriptors that fail the SDK's own GHAzDO2012 Open

Difficulty 4/5 3-5 days Newbie friendliness 58/100

microsoft/sarif-sdk#3075 · Opened Jun 21, 2026
publish-to-ghazdo/ghas skills: add post-publish verification + wrong-tenant (302) edge case Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

microsoft/sarif-sdk#3074 · Opened Jun 21, 2026
emit-sarif: document the TF_BUILD -> GHAZDO publishability coupling (local runs cannot be published) Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

microsoft/sarif-sdk#3064 · Opened Jun 19, 2026
emit-sarif: skill validates Sarif;AI only; GHAzDO ingestion checks (GHAzDO1014/1019/1020) are documented only in publish-to-ghazdo Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

microsoft/sarif-sdk#3063 · Opened Jun 19, 2026
emit-sarif: document that emit-finalize strips the AI1012-mandated ruleId sub-id (and relocates it nowhere) Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

microsoft/sarif-sdk#3061 · 1 comment · Opened Jun 19, 2026
v6.0.0 tracking: drop SARIF v1 + nullable enums + Newtonsoft->STJ (one coordinated break) Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

microsoft/sarif-sdk#3043 · 1 comment · Opened Jun 18, 2026
Migrate JSON serialization Newtonsoft.Json -> System.Text.Json (source-gen) to unblock NativeAOT Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

microsoft/sarif-sdk#3038 · 1 comment · Opened Jun 17, 2026
Re-evaluate PublishTrimmed on net8.0 for the multitool npm binaries (2020 evidence is stale) Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/sarif-sdk#3030 · Opened Jun 17, 2026
Tracking: robust, thread-safe target identification & file enumeration for the core SDK Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

microsoft/sarif-sdk#3019 · Opened Jun 14, 2026
Fast-follow: broaden VCP-driven emit-finalize rebasing (receipt-time validation, non-github hosts, multi-repo/submodule fixtures) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

microsoft/sarif-sdk#2972 · Opened Jun 5, 2026
Author finalized whole-log AI SARIF schema (ai-log.schema.json) and serve via get-schema emit-finalize Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 38/100

microsoft/sarif-sdk#2970 · Opened Jun 4, 2026
Streaming SarifLogger emits empty hashes for relative artifact URIs with a uriBaseId (precompute ignores originalUriBaseIds) Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

microsoft/sarif-sdk#2969 · Opened Jun 3, 2026
Proposal: canonical AI notification descriptor taxonomy in docs/ai/ Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

microsoft/sarif-sdk#2952 · 1 comment · Opened May 27, 2026
Adopt ILogger<T> DI + LoggerMessage source generator for multitool verbs Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 62/100

microsoft/sarif-sdk#2920 · Opened May 22, 2026
Enable Nullable reference types repo-wide Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

microsoft/sarif-sdk#2919 · Opened May 22, 2026
Migrate SDK from Newtonsoft.Json to System.Text.Json Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

microsoft/sarif-sdk#2917 · Opened May 22, 2026
SDK serializes index: -1 by default, then SDK validator flags it as a dangling reference Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

microsoft/sarif-sdk#2910 · 1 comment · Opened May 19, 2026
[RULE REQUEST] Validate versionControlProvenance (repositoryUri, revisionId, branch) Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sarif-sdk#2882 · Opened Dec 10, 2025
Expose underlying `Run` property in `SarifLogger` or otherwise improve its extensibility. Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sarif-sdk#2870 · Opened Sep 10, 2025
Minor issues with: sarif-sdk/docs /multitool-usage.md file Open

Difficulty 1/5 Under an hour Newbie friendliness 52/100

microsoft/sarif-sdk#2850 · Opened Jan 20, 2025
SARIF File Merge Results in Much Bigger Merge File Than Combination of Originals Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

microsoft/sarif-sdk#2849 · Opened Jan 13, 2025
Bug: Silent SARIF file merge failure when a text properly is emply/blank Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sarif-sdk#2848 · Opened Jan 13, 2025
Suggested SARIF File Merge Failure Improvements Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

microsoft/sarif-sdk#2847 · Opened Jan 10, 2025
Upgrade xunit and fix xunit analyzer errors Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2836 · Opened Oct 28, 2024
GH1017 log result and full description don't seem to align Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

microsoft/sarif-sdk#2822 · Opened Sep 28, 2024
GH1017 providing erroneous advice Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sarif-sdk#2821 · Opened Sep 28, 2024
SARIF Multitool file-work-items: Handling of Spaces in the DevOps Project name Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sarif-sdk#2818 · Opened Aug 16, 2024
Message string needs to escape curly braces Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

microsoft/sarif-sdk#2814 · 1 comment · Opened Jun 26, 2024
Null Reference Exception in SarifLogger when Extensions are specified. Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

microsoft/sarif-sdk#2808 · 1 comment · Opened Apr 26, 2024
Configurable size of preview text for region in ConstructMultilineContextSnippet Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2807 · 1 reaction · Opened Apr 24, 2024
[Feature Request] Nodes with default objects have null instead of the default object Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2803 · Opened Apr 5, 2024
SARIF1010.RuleIdMustBeConsistent falsely claims ruleId property is absent Open

Difficulty 2/5 1-3 hours Newbie friendliness 58/100

microsoft/sarif-sdk#2799 · Opened Mar 7, 2024
Valid SARIF file being rejected by GitHub with locationFromSarifResult error Open

Difficulty 4/5 3-5 days Newbie friendliness 30/100

microsoft/sarif-sdk#2770 · 2 comments · 3 reactions · Opened Jan 29, 2024
Declare Microsoft.Diagnostics.Tracing references as PrivateAssets Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

microsoft/sarif-sdk#2747 · 1 comment · Opened Dec 20, 2023
Microsoft.CodeAnalysis.Sarif.Query.QueryParseException: Expected compare operator but found <End> Open

Difficulty 3/5 1-2 days Newbie friendliness 30/100

microsoft/sarif-sdk#2733 · Opened Nov 13, 2023
Validating Visitor should not break on name changes Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sarif-sdk#2685 · Opened Jun 16, 2023
Many references to old packages Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2673 · Opened May 17, 2023
Look for missing defaults between SARIF Spec and Json Schema file Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2652 · Opened Apr 4, 2023
Make cache-results-by-file-hash configurable as a discrete option. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2620 · Opened Feb 16, 2023
`FileRegionsCache` multiline context region generation needs a look. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sarif-sdk#2617 · Opened Feb 13, 2023
Don't compare `ArtifactLocation.Index` inside `MatchedResult` Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sarif-sdk#2615 · 2 comments · 1 reaction · Opened Feb 10, 2023
VALIDATION: validator flags absence of `rules` data on driver even if rule descriptors can be found in an extension. Open

Difficulty 3/5 1-2 days Newbie friendliness 38/100

microsoft/sarif-sdk#2609 · Opened Jan 17, 2023
Add timeout to AnalyzeOptionsBase Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/sarif-sdk#2603 · Opened Jan 9, 2023
Disable CodeQL rule 'cs/linq/missed-where' Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

microsoft/sarif-sdk#2598 · 1 comment · Opened Dec 28, 2022

microsoft/sarif-sdk

Get new issues in your inbox