SARIF Ingestion Compatibility Preflight

Security and CI teams can run one command before uploading a third-party SARIF report to GitHub or GitLab. The command reads only the active editor, checks destination-specific compatibility requirements, and shows actionable remediation in a local output channel.

One workflow

1. Open a SARIF JSON report in VS Code.
2. Set sarifCompatibilityPreflight.destination to github or gitlab.
3. Run SARIF: Preflight Active Report from the Command Palette.
4. Review the PASS or FAIL result and remediation in the SARIF Compatibility Preflight output channel.

The command never modifies the report, contacts a network service, or guarantees that a destination will accept an upload. It catches invalid JSON, unsupported SARIF versions, missing core structures, and destination-specific rule or location omissions covered by this MVP.

Local verification

Requires an already available Node.js runtime. No dependency installation is needed.

node tests/run-tests.js
node scripts/package.js --check

Both commands are deterministic and read-only. The packaging command validates package visibility and metadata; it does not create or publish an archive.

Extension Development Host fixture

From this directory, start an Extension Development Host with the included success fixture:

code --extensionDevelopmentPath=. tests/fixtures/github-pass.sarif.json

In the new window, run SARIF: Preflight Active Report and expect PASS for the default GitHub destination. Then open tests/fixtures/gitlab-fail.sarif.json, select the GitLab destination, rerun the command, and expect actionable errors for the missing rule identifier and physical location.

The automated test also activates the extension against a deterministic VS Code API fixture and invokes the registered command through the same handler.

Privacy and security boundary

All processing is local and limited to active editor text. There is no telemetry, account, credential access, workspace scan, subprocess execution, or network access. Treat SARIF text and displayed scanner messages as untrusted input. The extension parses them as data and does not execute or interpolate their content.

See PRIVACY.md for the public privacy statement. Publication and marketplace actions remain unapproved.