Add SARIF (Static Analysis Results Interchange Format) output support

Feature

Add support for SARIF (Static Analysis Results Interchange Format) output format to mypy, similar to the existing --output=json option.

Pitch

SARIF is an OASIS standard format for static analysis results that is widely supported by modern CI/CD platforms and security tools:

• GitHub Advanced Security natively ingests SARIF files for code scanning alerts
• Azure DevOps supports SARIF for displaying security and code quality results
• GitLab can process SARIF reports for vulnerability tracking
• Many other security and code quality platforms (SonarQube, CodeQL, etc.) support SARIF

Other Python type checkers like Pyre already support SARIF output. Adding this to mypy would:

1. Improve integration with GitHub/Azure/GitLab security features
2. Make it easier to use mypy in enterprise CI/CD pipelines
3. Provide a standardized foundation for richer diagnostics supported by SARIF
4. Enable consumption by security tools that require standardized formats

Example Usage

# Generate SARIF output
mypy myproject/ --output=sarif > results.sarif

# Upload to GitHub Code Scanning (requires gzip + base64 encoding)
gzip -c results.sarif | base64 -w0 > results.sarif.gz.b64
gh api /repos/owner/repo/code-scanning/sarifs --method POST \
  --field commit_sha="$(git rev-parse HEAD)" \
  --field ref="refs/heads/main" \
  --field sarif="@results.sarif.gz.b64"

Implementation Notes

The implementation could likely build on the existing output formatter infrastructure:

1. Add a new SARIFFormatter class in mypy/error_formatter.py extending ErrorFormatter
2. Add "sarif" to the OUTPUT_CHOICES dictionary
3. Implement the SARIF v2.1.0 JSON schema

The MypyError class already provides the necessary diagnostic data (file path, line, column, error code, message, severity). Note that SARIF requires aggregating results into a single document structure rather than line-by-line output like JSON, which may require some adjustments to the formatter interface.

Related Issues

• #10816 (closed) - discussed multiple output formats including SARIF in comments
• #17612 - GitHub Actions workflow commands format (similar motivation)
• #20212 - Include summary in JSON output

References

• SARIF specification
• GitHub SARIF support documentation
• Microsoft SARIF Tutorials

Start in mypy/error_formatter.py by reading ErrorFormatter, MypyError, the existing JSON output path, and OUTPUT_CHOICES. Then review the SARIF v2.1.0 specification and determine how formatter output can be aggregated into one document. Done means mypy accepts --output=sarif and emits a SARIF-compatible report containing the available diagnostic data.