[LittleHuba]

Adds SARIF 2.1.0 as a third diagnostics format next to text and json. SARIF is understood by many CI, IDE and code-quality tools. Fixes #1528.

Usage

buildifier --mode=check --lint=warn --format=sarif -r . > buildifier.sarif

As with json, --format=sarif only works with --mode=check, and -v indents the output.

Mapping

• Each lint warning becomes a result at level warning. Its ruleId is the warning category, helpUri is the WARNINGS.md link, and the region is the start and end line and column.
• A file that needs reformatting becomes a file-level result (no region) with rule format, level warning.
• A file that can't be parsed becomes a file-level result with rule parse-error, level error.
• Rules are deduplicated per category.
• With no findings, the output is still a valid log with empty rules and results.

Design notes

• The serializer is a small in-tree struct set, so it adds no dependency.
• Findings carry no severity today (only actionable, which warn.go always sets to true). So every lint finding is a warning.
• autoFixable is not mapped. It would need SARIF fixes with replacement text, which can come in a follow-up.
• A format finding has no region, because buildifier doesn't track where the formatting differs.
• artifactLocation.uri is the path as passed on the command line, so run from the repo root with relative paths for repo-relative URIs.

Commits

1. Serializer (utils/sarif.go), unit tests, and the Format hook-up.
2. Accept --format=sarif in --mode=check and update the help text.
3. README section.
4. Integration tests with goldens, covering many files, a single file, stdin and an invalid file.

Additional testing

• Sample outputs validate against the official OASIS SARIF 2.1.0 schema.

[fmeum]

Thanks, this is really useful!

Just a nit and I will merge and release this.

[fmeum]

Follow-up review: two small SARIF 2.1.0 conformance gaps and two test nits. The suggestions can be applied as one batch. With all of them applied, go test ./buildifier/utils passes and gofmt is clean. The integration goldens still need the columnKind line, as described in the first comment.

[fmeum]

I also asked Claude for a review and it found a few things worth fixing regarding sarif compat.

[LittleHuba]

Resolved all findings. Found in addition one more hole with escaping curly braces.