globocom / huskyCI

Performing security tests inside your CI
https://huskyci.opensource.globo.com
BSD 3-Clause "New" or "Revised" License
572 stars 137 forks source link

SARIF Support #564

Open htrgouvea opened 1 year ago

htrgouvea commented 1 year ago

Hi folks!

I believe it would be very interesting if the project had support for SARIF [1]. SARIF is already a strong industry standard and I believe that all the tools that Husky uses already have this option.

With that, it would be a little simpler to integrate new SAST/SCA tools in Husky. We could also have a SARIF output to help make the information that Husky generates easy to migrate to other platforms. For example, with this we can drastically reduce the codes used to map the fields in the output for each tool.

Thanks!

[1] - https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.pdf