Topic · SARIF

What is SARIF, and how do I keep the findings true in CI?

Gist

SARIF is OASIS JSON for what a static analyzer already found. GitHub and Sonar display the file. Proof imports it. proof signals import --provider codeql --input codeql-results.sarif --signal-format sarif normalizes each result into proof.code_signals.v1 and proof audit --check code_signal_obligations_reviewed fails on unresolved rows. Proof is not a SARIF viewer. CodeQL still has to run. Jama still authors.

proof signals import --provider codeql --input codeql-results.sarif --signal-format sarif

Keep CodeQL, OpenGrep, or Semgrep as the producer. Keep SARIF Explorer if you need to read the JSON. An imported finding is not a proof of the code.

Request demo Last upload vs this matrix

01 · The file that sat unread

A SARIF upload is a report. It is not a named owner.

The interchange format exists so CodeQL, OpenGrep, GCC, and Checkov can emit the same JSON. CI can archive that JSON. Nobody has to say which shall owns the row.

OASIS SARIF v2.1.0 is the schema. A run carries tool, rules, and results. GitHub code scanning renders it. Sonar documents it. The VS Code SARIF Explorer lets a person click a result. None of those surfaces fail the build because SYS-REQ-1094 never accepted the class. Proof is the other step: map the provider rule to a stable signal_id, attach an obligation class, and fail code_signal_obligations_reviewed when the row is still unexplained.

The quality-gate H1 lives on Proof vs SonarQube. The security-findings H1 lives on Proof vs Snyk. This page is the interchange file those tools already emit, not a second static-analysis product.

proof signals import --provider codeql --input codeql-results.sarif --signal-format sarif
proof signals import --provider opengrep --input opengrep-results.sarif --signal-format sarif
proof signals collect --provider opengrep
proof signals matrix --format markdown
proof audit --check code_signal_obligations_reviewed

Normal proof audit does not run CodeQL. Refresh with proof signals collect or import a file the pipeline already wrote. OpenGrep and CodeQL default to SARIF when format is omitted. Semgrep JSON is a different shape. Native scanners can still green the check without proving OpenGrep ran; set fail_if_missing: true when the producer is mandatory.

02 · The exhibit

Same SARIF. An unread upload, or a named unresolved row.

The pipeline already wrote codeql-results.sarif. GitHub showed the alert. Click the tabs.

codeql-results.sarif

tool CodeQL
rule js/path-injection
level error

Uploaded

This push

The JSON landed in GitHub code scanning. No SYS-REQ. No obligation. The merge still went green.

Report only

codeql-results.sarif

Still last week's file. Still one rule. Still no named owner until import runs.

Keep the SARIF

Proof

Ask import + matrix
Gate unresolved row fails audit

No obligation · check fails

Same SARIF. An unread upload, or a named unresolved row. Click the tabs.

Surface	What they do	What Proof does	What we lose
SARIF file	OASIS JSON. Tool, rules, results. The interchange, not a product.	`proof signals import … --signal-format sarif` normalizes into `proof.code_signals.v1`.	Not a schema editor. Not SARIF 2.2.
GitHub code scanning	Uploads the file and shows alerts on the PR.	Does not upload. Imports a file the pipeline already wrote.	Not a GitHub App. Not a results UI.
SARIF Explorer	VS Code reads the JSON so a person can click a result.	Not this command. Matrix is the review surface.	Not a viewer.
CodeQL / OpenGrep	Produce SARIF. They are the analyzers.	`proof signals collect --provider opengrep` can run OpenGrep. CodeQL is import-only unless you wire the command.	Proof does not replace CodeQL. It does not ship a query pack.
SonarQube / Semgrep	Quality gate or rule pack. Sonar documents SARIF. Semgrep JSON is a different format.	Sonar stays on Proof vs SonarQube. Semgrep JSON uses `--signal-format semgrep`, not sarif.	Not a quality gate. Not Semgrep Cloud.
Jama / DOORS	Author and store the programme. They do not ingest CodeQL JSON.	Jama still authors. Proof holds the finding as a file audit can re-read. IBM DOORS stays a mention on Proof vs Jama.	Not an ALM. Jama still authors.

The teaching finding is one CodeQL path-injection result. The file still has to exist. Import still has to run. Audit still has to see an unexplained row.

proof signals import --provider codeql --input codeql-results.sarif --signal-format sarif
proof signals findings list --provider codeql
proof signals matrix --format markdown
proof audit --check code_signal_obligations_reviewed

Excludes live in provider exclude_paths, not in .gitignore. For SARIF providers, Proof filters the normalized output itself. Analyzer-native ignore files may shrink the scan; they are not the source of truth. A catalog-class hint on proof signals findings show is data, not an auto-applied obligation. Someone still runs proof req edit.

03 · The honest loss

An imported finding is not a proof of the code.

Proof does not write SARIF. It does not replace CodeQL. Jama still authors.

Proof is not a SARIF viewer and not a SARIF SDK. It does not implement CodeQL, Semgrep, or OpenGrep queries. Native scanners can satisfy code_signal_obligations_reviewed without proving an external producer ran. Audit does not refresh providers unless you collect, import, or set refresh_on_audit. A closed matrix row means the finding is owned and explained. It is not a proof that the function is correct. We have not run this against a frozen CodeQL, Semgrep, or OpenGrep corpus, and we have not scored it against SARIF Explorer or GitHub code scanning on the same pack. The loss is named, not scored.

The quality-gate H1 stays on Proof vs SonarQube. The security-findings H1 stays on Proof vs Snyk. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is Static Analysis Results Interchange Format? Same cluster. Same URL. Do not mint a twin.

Does Proof emit SARIF? No. It imports it. Keep the producer.

Is Semgrep SARIF? Semgrep JSON is a different --signal-format. OpenGrep and CodeQL default to SARIF.

Is this a SonarQube alternative? No. That H1 lives on Proof vs SonarQube.

Does audit run CodeQL? Not by default. Import the file, or collect a configured provider.

Is Proof CodeQL? No. Jama still authors. Proof binds the finding so CI can fail when the row has no owner.