SARIF Triage Viewer

A fork of Microsoft's SARIF Viewer for VS Code that adds durable suppressions, decision tracking, and export of updated SARIF.

Open a .sarif file and findings appear as squiggles in source and entries in the SARIF Results Panel. From there you can suppress individual findings with a justification and developer attribution, track approval for higher-severity issues, and export a clean .suppressed.sarif that carries every decision forward into the next analysis run.

Governance features (v3.5)

This fork adds the following capabilities on top of the upstream Microsoft SARIF Viewer v3.4.5.

Suppress / Unsuppress with attribution. Right-click any result in the Results Panel (or use the inline link in the details pane, or the editor hover Quick Fix menu) to suppress a finding. A three-step prompt collects justification text, a developer ID, and — for error and warning severity findings — a mandatory approver ID. Unsuppressing restores the original state in one click.

Bidirectional squiggle control. Suppressing a finding immediately removes its editor squiggle. Unsuppressing restores it. Pre-loaded suppressions (suppressions already present when the .sarif file is opened) behave identically to in-session suppressions.

Suppression metadata in the details pane. For any suppressed finding the Info tab shows who suppressed it, who approved it, and when — sourced directly from the SARIF Suppression object's property bag.

Dirty-state tracking and export. A status-bar indicator shows ⚠ Unsaved whenever in-memory suppression state differs from the file on disk. A one-time warning notification fires on the first change. Use SARIF › Export Updated SARIF to write the decisions to a new .suppressed.sarif file; the original is never overwritten.

Close-file warning. Closing a .sarif document with unsaved suppression changes triggers a prompt to export or discard before the log is removed.

Show Panel with file picker. Invoking SARIF › Show Panel when no logs are loaded opens a native file-open dialog filtered to .sarif instead of showing a blank panel.

Open rule explanation. When a rule's helpUri is set, the Rule Id in the details pane is a live link. %VAR% environment variable tokens in the URI are expanded at click time, supporting toolchains where the tool is not at a fixed path.

Suppression filter default. The Results Panel's Suppression filter now defaults to "visible", so suppressed results appear with strikethrough rather than disappearing from the list.

Resilient SARIF loading. Null or missing result entries and results that omit the technically-required message field are silently handled rather than crashing.

The SARIF file as provenance vehicle

Suppression decisions written by this extension follow the SARIF 2.1.0 Suppression schema exactly — kind: 'external', status: 'accepted', justification, and a properties bag carrying user, approver, and timestamp. No proprietary extensions. The .suppressed.sarif output can be read by any SARIF-aware tool, committed to source control alongside the code it describes, and fed back to the analysis engine so previously-reviewed findings are not re-triaged on the next run.

Usage

Open any .sarif file. The SARIF Results Panel opens automatically. To open a file from the panel, invoke SARIF › Show Panel (sarif.showPanel) with no logs loaded; a file-open dialog will appear.

To suppress a finding:

1. Select the result in the Results Panel or click a squiggle in the editor.
2. Click Suppress… in the details pane, right-click the result in the panel, or use the editor Quick Fix (lightbulb) menu.
3. Enter a justification, your developer ID, and (for error/warning findings) an approver ID.

To export decisions: SARIF › Export Updated SARIF (command sarif.exportSuppressed). A save dialog pre-fills <original>.suppressed.sarif.

Building from source

npm install
npm run vscode:prepublish   # compiles to out/
npx @vscode/vsce package    # produces sarif-triage-3.5.0.vsix
code --install-extension sarif-triage-3.5.0.vsix

Upstream

This extension is a fork of Microsoft SARIF Viewer for Visual Studio Code v3.4.5, published under the MIT License. All upstream functionality is preserved. See CHANGES.md for the complete list of files modified and features added.

Telemetry

The upstream telemetry from Microsoft (basic anonymous activation and log-version data) is retained. Opt in or out via the VS Code setting telemetry.enableTelemetry.

License

MIT — see LICENSE for details.