Sarif format: Include Severity level in a property

[marcandre-larochelle]

As per the title,

It would be useful to have a property which equates to the severity of the rule. Currently there are only "levels" which are one of:

• Error
• Warning
• Note
• None

I know Github suggest using the properties.problem.severity, sadly they also state it should only contain:

• Error
• Warning
• Recommendation

I would suggest using the following: properties.ansible-lint.severity with the following values (same as the ones currently used):

• Very High
• High
• Medium
• Low

Thanks in advance

[ssbarnea]

Please check https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html and see if there is something there that can be used to hold severity.

[marcandre-larochelle]

Hi,

The only field that could be used to hold the severity would be the rank property, the other ones (level / kind) have predefined sets of values possible which wouldn't allow for the granularity of the severities found in ansible-lint.

Rank property:
A result object MAY contain a property named rank whose value is a number between 0.0 and 100.0 inclusive, representing the priority or importance of the result. 0.0 is the lowest priority and 100.0 is the highest.

See: https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Ref531188379

Thanks.

[marcandre-larochelle]

Otherwise, the properties.tags[] could possibly be used, but then it harder to compare with other tools than using the rank property as it is not standardized (no predefined set of values and doesn't use a scale).

see: https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#reportingdescriptor-object