sarifix diff

sarifix diff¶

Print new, fixed and unchanged findings by fingerprint

Synopsis¶

Compare a base and a head SARIF set by fingerprint. Line numbers never count, so findings that only moved are unchanged.

Fingerprints come from primaryLocationLineHash when the tool provides it, then other partialFingerprints, then the sarifix/v1 fingerprint 'sarifix scan' recorded, then a hash of the finding's anchor: the flagged line, or for a block (a Terraform resource, a Kubernetes object) its shortest unique opening lines. Anchors are read from the files under --repo for head and --base-root for base (default --repo).

sarifix diff [flags]

Examples¶

  sarifix diff --base main.sarif --head pr.sarif
  sarifix diff --base 'base/*.sarif' --head 'sarif/*.sarif' --json

Options¶

      --base strings       base SARIF files or globs (required)
      --base-root string   checkout of the base commit, for reading snippets (default --repo)
      --head strings       head SARIF files or globs (required)
  -h, --help               help for diff
      --unchanged          also list unchanged findings

Options inherited from parent commands¶

      --config string       path to sarifix.yaml (default "sarifix.yaml")
      --json                machine-readable JSON output
      --log-level string    log level: debug, info, warn, error (default "info")
      --org-config string   org default config layered under --config
      --repo string         repository root (default ".")
      --settings string     settings file (default: search XDG config and home)