@microsoft/eslint-formatter-sarif

What is @microsoft/eslint-formatter-sarif?

@microsoft/eslint-formatter-sarif is an ESLint formatter that outputs results in the SARIF (Static Analysis Results Interchange Format) format. SARIF is a standardized format for the output of static analysis tools, which makes it easier to integrate with other tools and systems that consume SARIF.

What are @microsoft/eslint-formatter-sarif's main functionalities?

SARIF Formatting

This feature allows you to configure ESLint to use the SARIF formatter. The code sample shows an ESLint configuration file that specifies the use of @microsoft/eslint-formatter-sarif as the formatter.

module.exports = {
  "extends": "eslint:recommended",
  "formatter": "@microsoft/eslint-formatter-sarif",
  "rules": {
    "no-unused-vars": "warn",
    "no-console": "off"
  }
};

Integration with CI/CD

This feature demonstrates how to integrate the SARIF formatter with a CI/CD pipeline. The code sample shows a package.json script that runs ESLint with the SARIF formatter and outputs the results to a file named results.sarif.

{
  "scripts": {
    "lint": "eslint . -f @microsoft/eslint-formatter-sarif -o results.sarif"
  }
}

Other packages similar to @microsoft/eslint-formatter-sarif

eslint-formatter-json

eslint-formatter-json is an ESLint formatter that outputs results in JSON format. While it provides a structured output similar to SARIF, it lacks the standardization and interoperability features of SARIF.

eslint-formatter-checkstyle

eslint-formatter-checkstyle outputs ESLint results in Checkstyle XML format, which is useful for integration with tools that consume Checkstyle reports. However, it does not offer the same level of detail and standardization as SARIF.

eslint-formatter-tap

eslint-formatter-tap formats ESLint results in the TAP (Test Anything Protocol) format. This is useful for integration with TAP consumers but does not provide the same level of detail and standardization as SARIF.

README

SARIF formatter for ESLint

eslint-formatter-sarif is a formatter for ESLint that produces output in the SARIF (Static Analysis Results Interchange Format) v2.1.0 format.

It is available as an npm module @microsoft/eslint-formatter-sarif.

Installation and usage

1. To install ESLint, follow the instructions at Getting Started with ESLint.

2. To install the ESLint SARIF formatter:

   npm install @microsoft/eslint-formatter-sarif --save-dev
   

3. To run ESLint with the SARIF formatter:

   ./node-modules/.bin/eslint -f @microsoft/eslint-formatter-sarif -o yourfile.sarif yourfile.js
   

Note that you cannot use the abbreviated form -f sarif, because that only works when the npm module name is of the form eslint-formatter-example, and the ESLint SARIF formatter module is not eslint-formatter-sarif; it's @microsoft/eslint-formatter-sarif. Alternatively, you can use the form -f @microsoft/sarif.

Developer details

To embed the contents of the analyzed source files in the resulting SARIF file:

set SARIF_ESLINT_EMBED=true

To disable content embedding:

set SARIF_ESLINT_EMBED=

To run unit tests:

RunTests.cmd