Module sarif_parse 

SARIF 2.1.0 subset parser for external scanner findings.

Implements the minimal robust parse subset verified against SARIF 2.1.0:

• rule_id: result.ruleId else run.tool.driver.rules[ruleIndex].id
• path: locations[0].physicalLocation.artifactLocation.uri, with file:// scheme and leading ./ stripped; uriBaseId-agnostic
• start_line / end_line: NULLABLE (absent in many dialects)
• level: result → rule defaultConfiguration.level → "warning"
• fingerprint: partialFingerprints.primaryLocationLineHash → any partialFingerprints value → any fingerprints value → self-hash sha256(engine|rule_id|path|start_line)
• message.text

Unparseable individual results are skipped with tracing::warn; a document that is not SARIF at all (missing version or runs) returns Err.

Structs

ExternalFinding

A single normalized external finding extracted from a SARIF document.

Functions

parse_sarif_with_engines

Parse a SARIF 2.1.0 document once, returning both the normalized findings and every scanner engine name present across all runs.

self_hash_fingerprint

Compute the self-hash fingerprint fallback: sha256(engine|rule_id|path| start_line), prefixed sha256:. An absent start_line contributes an empty final part.