@microsoft/sarif-multitool-darwin 4.6.4 → 5.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/Sarif.Converters.pdb +0 -0
- package/Sarif.Driver.pdb +0 -0
- package/Sarif.Multitool +0 -0
- package/Sarif.Multitool.Library.pdb +0 -0
- package/Sarif.Multitool.Library.xml +507 -70
- package/Sarif.Multitool.pdb +0 -0
- package/Sarif.WorkItems.pdb +0 -0
- package/Sarif.pdb +0 -0
- package/Sarif.xml +604 -1
- package/WorkItems.pdb +0 -0
- package/package.json +1 -1
|
@@ -4,6 +4,301 @@
|
|
|
4
4
|
<name>Sarif.Multitool.Library</name>
|
|
5
5
|
</assembly>
|
|
6
6
|
<members>
|
|
7
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddNotificationCommand">
|
|
8
|
+
<summary>
|
|
9
|
+
Implements <c>multitool add-notification</c>: appends a fully-formed SARIF notification
|
|
10
|
+
JSON to <c><output>.wip.jsonl</c>.
|
|
11
|
+
</summary>
|
|
12
|
+
<remarks>
|
|
13
|
+
<para>Unlike <see cref="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddResultCommand"/>, this verb does not enforce the AI ruleId
|
|
14
|
+
convention on the notification's <c>associatedRule.id</c> — that field references a
|
|
15
|
+
descriptor in <c>tool.driver.rules</c>, which uses the base taxonomy id (e.g.,
|
|
16
|
+
<c>CWE-79</c>) per SARIF §3.49.3, not the result-side hierarchical form.</para>
|
|
17
|
+
<para>Notifications without a <c>timeUtc</c> stamp are auto-stamped at replay time
|
|
18
|
+
(<see cref="T:Microsoft.CodeAnalysis.Sarif.Emit.SarifEventReplayer"/>), so producers can omit that field without firing
|
|
19
|
+
AI2019 at validate time.</para>
|
|
20
|
+
</remarks>
|
|
21
|
+
</member>
|
|
22
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddNotificationOptions">
|
|
23
|
+
<summary>
|
|
24
|
+
Options for <c>add-notification</c>, which appends a fully-formed SARIF <c>notification</c>
|
|
25
|
+
object to a staged event log (<c><output>.wip.jsonl</c>) created by
|
|
26
|
+
<c>emit-init-run</c>.
|
|
27
|
+
</summary>
|
|
28
|
+
<remarks>
|
|
29
|
+
The notification is supplied as a JSON document (file via <c>--input</c> or piped on
|
|
30
|
+
stdin). AI producers are expected to emit notifications with potentially very rich data
|
|
31
|
+
— associated rule references, full exception trees, descriptive markdown messages,
|
|
32
|
+
per-call properties — so the JSON-payload contract avoids encoding-by-flag entirely and
|
|
33
|
+
preserves whatever the producer chose to express.
|
|
34
|
+
</remarks>
|
|
35
|
+
</member>
|
|
36
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddReportingDescriptorCommand">
|
|
37
|
+
<summary>
|
|
38
|
+
Implements <c>multitool add-reporting-descriptor</c>: validates a fully-formed SARIF
|
|
39
|
+
reportingDescriptor JSON and appends an event to <c><output>.wip.jsonl</c>.
|
|
40
|
+
</summary>
|
|
41
|
+
<remarks>
|
|
42
|
+
<para>Default target is <c>run.tool.driver.notifications[]</c>; pass <c>--rules</c> to
|
|
43
|
+
target <c>run.tool.driver.rules[]</c> instead.</para>
|
|
44
|
+
<para>On the <c>--rules</c> path, the descriptor id is gated against
|
|
45
|
+
<see cref="M:Microsoft.CodeAnalysis.Sarif.Emit.AIRuleIdConvention.IsNovel(System.String)"/>: only NOVEL- prefixed ids are accepted.
|
|
46
|
+
Taxonomy-mapped rule descriptors (e.g., <c>CWE-89</c>) come from the taxonomy enricher
|
|
47
|
+
at finalize time, not from this verb — this verb is the producer-side authoring path
|
|
48
|
+
for novel-finding descriptors that have no upstream taxonomy entry.</para>
|
|
49
|
+
<para>Duplicate-id submissions within the same event log are rejected on receipt — the
|
|
50
|
+
verb scans the existing event log (including any descriptors pre-populated on the
|
|
51
|
+
run-header event) and fails before appending. (A future <c>--force</c> escape hatch
|
|
52
|
+
is acknowledged; not in v1.)</para>
|
|
53
|
+
</remarks>
|
|
54
|
+
</member>
|
|
55
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.AddReportingDescriptorCommand.TryFindDuplicate(System.String,System.String,System.String,System.String,System.String@)">
|
|
56
|
+
<summary>
|
|
57
|
+
Scans the staged event log for a prior descriptor with the same id targeting the
|
|
58
|
+
same array. Returns <c>true</c> with <paramref name="error"/> populated when a
|
|
59
|
+
duplicate is found; <c>false</c> otherwise.
|
|
60
|
+
</summary>
|
|
61
|
+
<remarks>
|
|
62
|
+
Two sources are checked:
|
|
63
|
+
<list type="bullet">
|
|
64
|
+
<item><description>Run-header events: <c>payload.tool.driver.<targetArray>[*].id</c>
|
|
65
|
+
— producers MAY pre-populate descriptors on the header.</description></item>
|
|
66
|
+
<item><description>Prior descriptor events of the same target kind:
|
|
67
|
+
<c>payload.id</c>.</description></item>
|
|
68
|
+
</list>
|
|
69
|
+
The reader silently skips unknown kinds and malformed-but-skippable rows; for the
|
|
70
|
+
scan we walk the full event sequence so the event index reported in the error
|
|
71
|
+
matches the producer's mental model of "the Nth thing I appended."
|
|
72
|
+
</remarks>
|
|
73
|
+
</member>
|
|
74
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddReportingDescriptorOptions">
|
|
75
|
+
<summary>
|
|
76
|
+
Options for <c>add-reporting-descriptor</c>, which appends a fully-formed SARIF
|
|
77
|
+
<c>reportingDescriptor</c> object to a staged event log
|
|
78
|
+
(<c><output>.wip.jsonl</c>) created by <c>emit-init-run</c>.
|
|
79
|
+
</summary>
|
|
80
|
+
<remarks>
|
|
81
|
+
<para>The verb's default target is <c>run.tool.driver.notifications[]</c> — AI producers
|
|
82
|
+
routinely emit notification descriptors (progress, telemetry, config errors, handoff
|
|
83
|
+
breadcrumbs). Pass <c>--rules</c> to target <c>run.tool.driver.rules[]</c> instead;
|
|
84
|
+
this rule-descriptor path is reserved for NOVEL- novel-finding descriptors (taxonomy
|
|
85
|
+
rule descriptors such as <c>CWE-89</c> come from the taxonomy enricher, not this
|
|
86
|
+
verb).</para>
|
|
87
|
+
<para>The descriptor is supplied as a JSON document (file via <c>--input</c> or piped
|
|
88
|
+
on stdin). The full SARIF reportingDescriptor shape (id, name, shortDescription,
|
|
89
|
+
fullDescription, helpUri, messageStrings, defaultConfiguration, properties, …)
|
|
90
|
+
round-trips byte-for-byte through the staged event log.</para>
|
|
91
|
+
<para>Each descriptor <c>id</c> may appear at most once per event log. Submitting a
|
|
92
|
+
duplicate id is rejected with a clear error pointing at the prior occurrence.</para>
|
|
93
|
+
</remarks>
|
|
94
|
+
</member>
|
|
95
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddResultCommand">
|
|
96
|
+
<summary>
|
|
97
|
+
Implements <c>multitool add-result</c>: validates a fully-formed SARIF result JSON and
|
|
98
|
+
appends a <c>result</c> event to <c><output>.wip.jsonl</c>.
|
|
99
|
+
</summary>
|
|
100
|
+
<remarks>
|
|
101
|
+
The result's <c>ruleId</c> is validated at receipt against the AI ruleId convention
|
|
102
|
+
(taxonomy sub-id form or NOVEL- escape hatch). On rejection the verb writes the
|
|
103
|
+
AI-consumable error envelope (error code AI-RULEID-001) to stderr and returns
|
|
104
|
+
<see cref="F:Microsoft.CodeAnalysis.Sarif.Driver.CommandBase.FAILURE"/> WITHOUT appending — an AI orchestrator can retry the
|
|
105
|
+
individual result without first having to remove garbage from the event log.
|
|
106
|
+
</remarks>
|
|
107
|
+
</member>
|
|
108
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AddResultOptions">
|
|
109
|
+
<summary>
|
|
110
|
+
Options for <c>add-result</c>, which appends a fully-formed SARIF <c>result</c> object
|
|
111
|
+
to a staged event log (<c><output>.wip.jsonl</c>) created by <c>emit-init-run</c>.
|
|
112
|
+
</summary>
|
|
113
|
+
<remarks>
|
|
114
|
+
The result is supplied as a JSON document (file via <c>--input</c> or piped on stdin).
|
|
115
|
+
The SARIF <c>result</c> object can carry rich nested structures (code flows, thread flows,
|
|
116
|
+
stacks, fixes, taxa, related locations, properties bags). Modeling every field as a CLI
|
|
117
|
+
flag would explode the surface; the JSON-payload contract keeps the verb generic and lets
|
|
118
|
+
an AI producer emit arbitrarily-rich findings without losing fidelity.
|
|
119
|
+
|
|
120
|
+
On receipt the verb validates that <c>result.ruleId</c> conforms to the AI ruleId
|
|
121
|
+
convention (taxonomy sub-id form or NOVEL- escape hatch) so an AI orchestrator gets an
|
|
122
|
+
immediate, AI-consumable rejection envelope rather than discovering the violation later
|
|
123
|
+
at <c>emit-finalize</c> time.
|
|
124
|
+
</remarks>
|
|
125
|
+
</member>
|
|
126
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext">
|
|
127
|
+
<summary>
|
|
128
|
+
Detects an Azure DevOps pipeline execution context from environment variables and stamps
|
|
129
|
+
the corresponding <c>automationDetails</c> shape onto a <see cref="T:Microsoft.CodeAnalysis.Sarif.Run"/>, matching the
|
|
130
|
+
canonical write surface used by the Azure DevOps Advanced Security SARIF upload SDK
|
|
131
|
+
(<c>AlertHttpClientExtensions.AddAutomationDetails</c>).
|
|
132
|
+
</summary>
|
|
133
|
+
<remarks>
|
|
134
|
+
<para>Detection is gated on the standard ADO sentinel <c>TF_BUILD=True</c>. When not
|
|
135
|
+
running inside an ADO pipeline, <see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.None"/> is returned and no
|
|
136
|
+
stamping occurs. This avoids surprising failures on non-ADO CI systems that happen to
|
|
137
|
+
populate a subset of <c>BUILD_*</c> variables.</para>
|
|
138
|
+
<para>Inside an ADO pipeline three states are possible:</para>
|
|
139
|
+
<list type="bullet">
|
|
140
|
+
<item><see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.Complete"/> — every required logical variable is present
|
|
141
|
+
and well-formed; <see cref="M:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.ApplyTo(Microsoft.CodeAnalysis.Sarif.Run)"/> writes <c>automationDetails.id</c> plus the
|
|
142
|
+
four <c>azuredevops/pipeline/build/*</c> property keys that ADO ingestion validates.</item>
|
|
143
|
+
<item><see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.None"/> — no required variables are populated; nothing is
|
|
144
|
+
stamped (e.g. a manual local invocation that happens to have <c>TF_BUILD</c> set without
|
|
145
|
+
the rest).</item>
|
|
146
|
+
<item><see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.Partial"/> — one or more required variables are present
|
|
147
|
+
but others are missing or malformed; a partial pipeline identity is a misconfiguration
|
|
148
|
+
signal, not a soft skip, so callers should fail loudly rather than emit half-stamped
|
|
149
|
+
SARIF that will fail GHAzDO1019/1020 downstream.</item>
|
|
150
|
+
</list>
|
|
151
|
+
</remarks>
|
|
152
|
+
</member>
|
|
153
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.TryDetect(Microsoft.CodeAnalysis.Sarif.Multitool.IEnvironmentVariableGetter,Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext@,System.String@)">
|
|
154
|
+
<summary>
|
|
155
|
+
Reads ADO predefined environment variables via <paramref name="environment"/> and
|
|
156
|
+
returns one of <see cref="T:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState"/>.
|
|
157
|
+
</summary>
|
|
158
|
+
<param name="environment">Env getter (test seam).</param>
|
|
159
|
+
<param name="context">Populated context when state is <see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.Complete"/>; otherwise <c>null</c>.</param>
|
|
160
|
+
<param name="errorMessage">Human-readable description of present/missing/malformed variables when state is <see cref="F:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.DetectionState.Partial"/>; otherwise <c>null</c>.</param>
|
|
161
|
+
</member>
|
|
162
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.AdoPipelineContext.ApplyTo(Microsoft.CodeAnalysis.Sarif.Run)">
|
|
163
|
+
<summary>
|
|
164
|
+
Stamps the detected pipeline identity onto <paramref name="run"/>.
|
|
165
|
+
Creates <see cref="P:Microsoft.CodeAnalysis.Sarif.Run.AutomationDetails"/> if absent; does not overwrite
|
|
166
|
+
<c>Guid</c> or <c>CorrelationGuid</c> fields populated from other sources.
|
|
167
|
+
</summary>
|
|
168
|
+
</member>
|
|
169
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.EmitEventLogHelpers">
|
|
170
|
+
<summary>
|
|
171
|
+
Shared plumbing for the emit verb chain (<c>emit-init-run</c>, <c>add-result</c>,
|
|
172
|
+
<c>add-notification</c>, <c>emit-finalize</c>): resolves the staged event log path,
|
|
173
|
+
reads caller-supplied JSON (file or stdin), and parses it into a
|
|
174
|
+
<see cref="T:Newtonsoft.Json.Linq.JToken"/> in a date-safe way.
|
|
175
|
+
</summary>
|
|
176
|
+
<remarks>
|
|
177
|
+
The verbs share three concerns — locating <c><output>.wip.jsonl</c>, sourcing
|
|
178
|
+
the payload, and parsing it without lossy normalization — which live here so the
|
|
179
|
+
per-verb commands can stay focused on payload-specific validation and append.
|
|
180
|
+
</remarks>
|
|
181
|
+
</member>
|
|
182
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.EmitEventLogHelpers.TryValidateUri(System.String,System.String,System.String[],System.String@)">
|
|
183
|
+
<summary>
|
|
184
|
+
Validates that <paramref name="value"/> is either null/empty or a well-formed
|
|
185
|
+
absolute URI whose scheme appears in <paramref name="allowedSchemes"/>.
|
|
186
|
+
</summary>
|
|
187
|
+
<remarks>
|
|
188
|
+
Returning <c>true</c> when the value is empty preserves the "flag is optional"
|
|
189
|
+
contract — only supplied URIs are validated. We require an absolute URI (relative
|
|
190
|
+
values would never resolve meaningfully into a SARIF reader downstream) and we
|
|
191
|
+
constrain the scheme to a documented allow-list so a typo like <c>"htps://..."</c>
|
|
192
|
+
or an inappropriate scheme like <c>"file:..."</c> on a public-facing URL surfaces
|
|
193
|
+
here rather than silently shipping in the run header.
|
|
194
|
+
</remarks>
|
|
195
|
+
</member>
|
|
196
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.EmitEventLogHelpers.TryResolveWipPath(System.String,Microsoft.CodeAnalysis.Sarif.IFileSystem,System.String@)">
|
|
197
|
+
<summary>
|
|
198
|
+
Resolves the staged event-log path for an output SARIF path and verifies it exists.
|
|
199
|
+
</summary>
|
|
200
|
+
<param name="outputFilePath">The final SARIF file path (positional verb argument).</param>
|
|
201
|
+
<param name="fileSystem">The file system facade.</param>
|
|
202
|
+
<param name="wipPath">Set to the absolute event-log path on success.</param>
|
|
203
|
+
<returns><see cref="F:Microsoft.CodeAnalysis.Sarif.Driver.CommandBase.SUCCESS"/> on success, <see cref="F:Microsoft.CodeAnalysis.Sarif.Driver.CommandBase.FAILURE"/>
|
|
204
|
+
with a stderr message otherwise.</returns>
|
|
205
|
+
</member>
|
|
206
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.EmitEventLogHelpers.TryReadJsonPayload(System.String,System.String,Microsoft.CodeAnalysis.Sarif.IFileSystem,Newtonsoft.Json.Linq.JToken@)">
|
|
207
|
+
<summary>
|
|
208
|
+
Reads the caller-supplied JSON from <paramref name="inputFilePath"/> or stdin and
|
|
209
|
+
parses it. Returns <see cref="F:Microsoft.CodeAnalysis.Sarif.Driver.CommandBase.SUCCESS"/> with <paramref name="payload"/>
|
|
210
|
+
populated, or <see cref="F:Microsoft.CodeAnalysis.Sarif.Driver.CommandBase.FAILURE"/> with a stderr message describing
|
|
211
|
+
what went wrong.
|
|
212
|
+
</summary>
|
|
213
|
+
<param name="inputFilePath">File path supplied by <c>--input</c>, or null/empty to
|
|
214
|
+
read from stdin.</param>
|
|
215
|
+
<param name="payloadKind">Human-readable label used in error messages ("result",
|
|
216
|
+
"notification", ...).</param>
|
|
217
|
+
<param name="fileSystem">The file system facade.</param>
|
|
218
|
+
<param name="payload">Set to the parsed payload on success.</param>
|
|
219
|
+
</member>
|
|
220
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.EmitEventLogHelpers.ReadStandardInputAsUtf8">
|
|
221
|
+
<summary>
|
|
222
|
+
Reads redirected stdin as UTF-8, bypassing <see cref="P:System.Console.InputEncoding"/>.
|
|
223
|
+
On Windows the console's default input encoding is the active OEM codepage
|
|
224
|
+
(often cp437 or cp850), which would mangle non-ASCII content in a piped
|
|
225
|
+
SARIF payload. AI orchestrators routinely emit messages, URIs, and properties
|
|
226
|
+
containing non-ASCII characters, so we must decode the raw byte stream as UTF-8
|
|
227
|
+
regardless of the console's current code page. A BOM-stamped input is still
|
|
228
|
+
honored — <see cref="T:System.IO.StreamReader"/>'s detect-BOM flag handles that case.
|
|
229
|
+
</summary>
|
|
230
|
+
</member>
|
|
231
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.EmitFinalizeCommand">
|
|
232
|
+
<summary>
|
|
233
|
+
Implements <c>multitool emit-finalize</c>: replays <c><output>.wip.jsonl</c>,
|
|
234
|
+
optionally enriches CWE-as-rule-id descriptors, and atomically writes the destination
|
|
235
|
+
SARIF file.
|
|
236
|
+
</summary>
|
|
237
|
+
</member>
|
|
238
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.EmitFinalizeCommand.RunValidatorAndReport(System.String)">
|
|
239
|
+
<summary>
|
|
240
|
+
Runs the multitool validator (--rule-kind Sarif;AI) against the finalized SARIF.
|
|
241
|
+
Prints a one-line summary of Error/Warning/Note counts and (on Error) the rule IDs
|
|
242
|
+
that fired. Returns FAILURE if any Error-level finding is reported; otherwise SUCCESS.
|
|
243
|
+
</summary>
|
|
244
|
+
</member>
|
|
245
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.EmitFinalizeOptions">
|
|
246
|
+
<summary>
|
|
247
|
+
Options for <c>emit-finalize</c>, which replays the staged event log and atomically
|
|
248
|
+
writes the destination SARIF file.
|
|
249
|
+
</summary>
|
|
250
|
+
</member>
|
|
251
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.EmitInitRunCommand">
|
|
252
|
+
<summary>
|
|
253
|
+
Implements <c>multitool emit-init-run</c>: creates an append-only SARIF event log
|
|
254
|
+
(<c><output>.wip.jsonl</c>) seeded with a <c>run-header</c> event built from the
|
|
255
|
+
supplied tool / repo flags.
|
|
256
|
+
</summary>
|
|
257
|
+
<remarks>
|
|
258
|
+
<para>State table:</para>
|
|
259
|
+
<list type="table">
|
|
260
|
+
<listheader>
|
|
261
|
+
<term>State</term>
|
|
262
|
+
<term>No <c>--force-overwrite</c></term>
|
|
263
|
+
<term>With <c>--force-overwrite</c></term>
|
|
264
|
+
</listheader>
|
|
265
|
+
<item>
|
|
266
|
+
<term>Neither .sarif nor .wip.jsonl exists</term>
|
|
267
|
+
<term>Create new .wip.jsonl</term>
|
|
268
|
+
<term>Create new .wip.jsonl</term>
|
|
269
|
+
</item>
|
|
270
|
+
<item>
|
|
271
|
+
<term>.sarif exists, no .wip.jsonl</term>
|
|
272
|
+
<term>Fail — would clobber a committed SARIF on finalize</term>
|
|
273
|
+
<term>Create new .wip.jsonl (existing .sarif is left until finalize replaces it)</term>
|
|
274
|
+
</item>
|
|
275
|
+
<item>
|
|
276
|
+
<term>No .sarif, .wip.jsonl exists</term>
|
|
277
|
+
<term>Fail — another authoring session is in flight (or was crashed)</term>
|
|
278
|
+
<term>Delete .wip.jsonl and recreate</term>
|
|
279
|
+
</item>
|
|
280
|
+
<item>
|
|
281
|
+
<term>Both .sarif and .wip.jsonl exist</term>
|
|
282
|
+
<term>Fail</term>
|
|
283
|
+
<term>Delete .wip.jsonl and recreate</term>
|
|
284
|
+
</item>
|
|
285
|
+
</list>
|
|
286
|
+
</remarks>
|
|
287
|
+
</member>
|
|
288
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.EmitInitRunOptions">
|
|
289
|
+
<summary>
|
|
290
|
+
Options for <c>emit-init-run</c>, which opens an append-only event log
|
|
291
|
+
(<c><output>.wip.jsonl</c>) seeded with a <c>run-header</c> event for the supplied
|
|
292
|
+
tool. Subsequent producers append events to the log via the SARIF emit API and finalize
|
|
293
|
+
via <c>multitool emit-finalize</c>.
|
|
294
|
+
</summary>
|
|
295
|
+
<remarks>
|
|
296
|
+
CLI flags mirror the SARIF interior paths they populate (e.g., <c>--tool-driver-name</c>
|
|
297
|
+
populates <c>run.tool.driver.name</c>; <c>--vcp-revisionid</c> populates
|
|
298
|
+
<c>run.versionControlProvenance[0].revisionId</c>). This trades verbosity for a one-to-one
|
|
299
|
+
mapping that a SARIF-literate user can read without a help page.
|
|
300
|
+
</remarks>
|
|
301
|
+
</member>
|
|
7
302
|
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.FileWorkItemsCommand">
|
|
8
303
|
<summary>
|
|
9
304
|
A class that drives SARIF work item filing. This class is responsible for
|
|
@@ -105,46 +400,6 @@
|
|
|
105
400
|
and shows results.
|
|
106
401
|
</summary>
|
|
107
402
|
</member>
|
|
108
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoReferenceFinalSchema.Id">
|
|
109
|
-
<summary>
|
|
110
|
-
ADO1011
|
|
111
|
-
</summary>
|
|
112
|
-
</member>
|
|
113
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredSarifLogProperties.Id">
|
|
114
|
-
<summary>
|
|
115
|
-
ADO1013
|
|
116
|
-
</summary>
|
|
117
|
-
</member>
|
|
118
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredRunProperties.Id">
|
|
119
|
-
<summary>
|
|
120
|
-
ADO1014
|
|
121
|
-
</summary>
|
|
122
|
-
</member>
|
|
123
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredResultProperties.Id">
|
|
124
|
-
<summary>
|
|
125
|
-
ADO1015
|
|
126
|
-
</summary>
|
|
127
|
-
</member>
|
|
128
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredLocationProperties.Id">
|
|
129
|
-
<summary>
|
|
130
|
-
ADO1016
|
|
131
|
-
</summary>
|
|
132
|
-
</member>
|
|
133
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredPhysicalLocationProperties.Id">
|
|
134
|
-
<summary>
|
|
135
|
-
ADO1017
|
|
136
|
-
</summary>
|
|
137
|
-
</member>
|
|
138
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredToolProperties.Id">
|
|
139
|
-
<summary>
|
|
140
|
-
ADO1018
|
|
141
|
-
</summary>
|
|
142
|
-
</member>
|
|
143
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AdoProvideRequiredReportingDescriptorProperties.Id">
|
|
144
|
-
<summary>
|
|
145
|
-
ADO2012
|
|
146
|
-
</summary>
|
|
147
|
-
</member>
|
|
148
403
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.AIProvideRequiredRegionProperties.Id">
|
|
149
404
|
<summary>
|
|
150
405
|
AI1003
|
|
@@ -185,11 +440,6 @@
|
|
|
185
440
|
AI1013
|
|
186
441
|
</summary>
|
|
187
442
|
</member>
|
|
188
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ExecutionNotificationPlacement.Id">
|
|
189
|
-
<summary>
|
|
190
|
-
AI1014
|
|
191
|
-
</summary>
|
|
192
|
-
</member>
|
|
193
443
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideSemanticVersion.Id">
|
|
194
444
|
<summary>
|
|
195
445
|
AI2003
|
|
@@ -235,7 +485,7 @@
|
|
|
235
485
|
AI2017
|
|
236
486
|
</summary>
|
|
237
487
|
</member>
|
|
238
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.
|
|
488
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideLearningSignalArtifact.Id">
|
|
239
489
|
<summary>
|
|
240
490
|
AI2018
|
|
241
491
|
</summary>
|
|
@@ -255,6 +505,33 @@
|
|
|
255
505
|
of the schema is valid.
|
|
256
506
|
</summary>
|
|
257
507
|
</member>
|
|
508
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.EvidenceJsonReader">
|
|
509
|
+
<summary>
|
|
510
|
+
Defensive reads of <c>ai/evidence</c> entry properties. Producers in the
|
|
511
|
+
wild emit some properties (e.g. <c>backing</c>) as either a single
|
|
512
|
+
string or as an array of strings; a validator rule must accept both
|
|
513
|
+
shapes without throwing on well-formed input.
|
|
514
|
+
</summary>
|
|
515
|
+
</member>
|
|
516
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.EvidenceJsonReader.ReadString(Newtonsoft.Json.Linq.JObject,System.String)">
|
|
517
|
+
<summary>
|
|
518
|
+
Reads <paramref name="propertyName"/> from <paramref name="entry"/>
|
|
519
|
+
as a string. Returns null if the property is absent or not a JSON
|
|
520
|
+
string token (i.e., array, object, number, boolean, null).
|
|
521
|
+
</summary>
|
|
522
|
+
</member>
|
|
523
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.EvidenceJsonReader.ReadStrings(Newtonsoft.Json.Linq.JObject,System.String)">
|
|
524
|
+
<summary>
|
|
525
|
+
Reads <paramref name="propertyName"/> from <paramref name="entry"/>
|
|
526
|
+
as a list of strings. Accepts both shapes:
|
|
527
|
+
<list type="bullet">
|
|
528
|
+
<item>a single JSON string (yields a one-element list);</item>
|
|
529
|
+
<item>a JSON array of strings (non-string array elements are silently dropped).</item>
|
|
530
|
+
</list>
|
|
531
|
+
Returns an empty list when the property is absent, null-valued, or any
|
|
532
|
+
other JSON shape (object, number, boolean).
|
|
533
|
+
</summary>
|
|
534
|
+
</member>
|
|
258
535
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideRequiredLocationProperties.Id">
|
|
259
536
|
<summary>
|
|
260
537
|
GH1001
|
|
@@ -345,6 +622,76 @@
|
|
|
345
622
|
GH2012
|
|
346
623
|
</summary>
|
|
347
624
|
</member>
|
|
625
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOReferenceFinalSchema.Id">
|
|
626
|
+
<summary>
|
|
627
|
+
GHAzDO1011
|
|
628
|
+
</summary>
|
|
629
|
+
</member>
|
|
630
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredSarifLogProperties.Id">
|
|
631
|
+
<summary>
|
|
632
|
+
GHAzDO1013
|
|
633
|
+
</summary>
|
|
634
|
+
</member>
|
|
635
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredRunProperties.Id">
|
|
636
|
+
<summary>
|
|
637
|
+
GHAzDO1014
|
|
638
|
+
</summary>
|
|
639
|
+
</member>
|
|
640
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredResultProperties.Id">
|
|
641
|
+
<summary>
|
|
642
|
+
GHAzDO1015
|
|
643
|
+
</summary>
|
|
644
|
+
</member>
|
|
645
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredLocationProperties.Id">
|
|
646
|
+
<summary>
|
|
647
|
+
GHAzDO1016
|
|
648
|
+
</summary>
|
|
649
|
+
</member>
|
|
650
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredPhysicalLocationProperties.Id">
|
|
651
|
+
<summary>
|
|
652
|
+
GHAzDO1017
|
|
653
|
+
</summary>
|
|
654
|
+
</member>
|
|
655
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredToolProperties.Id">
|
|
656
|
+
<summary>
|
|
657
|
+
GHAzDO1018
|
|
658
|
+
</summary>
|
|
659
|
+
</member>
|
|
660
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvidePipelineProperties">
|
|
661
|
+
<summary>
|
|
662
|
+
GHAzDO1019 — when run.automationDetails is present, require the four
|
|
663
|
+
`azuredevops/pipeline/build/*` properties that GHAzDO ingestion reads to
|
|
664
|
+
identify the build definition + phase. Missing or unparseable values cause
|
|
665
|
+
ingestion to drop the run with "SarifValidation_MissingAdoPipelineProperties".
|
|
666
|
+
|
|
667
|
+
Required keys (all under run.automationDetails.properties):
|
|
668
|
+
azuredevops/pipeline/build/buildDefinitionId (int, != 0)
|
|
669
|
+
azuredevops/pipeline/build/buildDefinitionName (non-empty string)
|
|
670
|
+
azuredevops/pipeline/build/phaseId (GUID, != Guid.Empty)
|
|
671
|
+
azuredevops/pipeline/build/phaseName (non-empty string)
|
|
672
|
+
|
|
673
|
+
Source of truth: AdvancedSecurity.Service ./SarifUtils/SarifExtensions.cs
|
|
674
|
+
`GetPipeline(Run)` and CodeScanningResultPluginBase.ValidateRun.
|
|
675
|
+
</summary>
|
|
676
|
+
</member>
|
|
677
|
+
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideAutomationDetailsIdFormat">
|
|
678
|
+
<summary>
|
|
679
|
+
GHAzDO1020 — when run.automationDetails.id is present, require it to start
|
|
680
|
+
with the canonical `azuredevops/pipeline/build/` prefix. GHAzDO ingestion
|
|
681
|
+
parses the slash-delimited remainder as
|
|
682
|
+
`<org>/<project>/<buildDefId>/<phaseId>/<branch>/<buildId>`;
|
|
683
|
+
IDs that don't carry the prefix fail downstream parsing.
|
|
684
|
+
|
|
685
|
+
Source of truth: AdvancedSecurity.Service runAutomationDetails.Id consumers.
|
|
686
|
+
We deliberately validate only the prefix here — the slash content is derived
|
|
687
|
+
from pipeline state and not authored by hand.
|
|
688
|
+
</summary>
|
|
689
|
+
</member>
|
|
690
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.GHAzDOProvideRequiredReportingDescriptorProperties.Id">
|
|
691
|
+
<summary>
|
|
692
|
+
GHAzDO2012
|
|
693
|
+
</summary>
|
|
694
|
+
</member>
|
|
348
695
|
<member name="T:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources">
|
|
349
696
|
<summary>
|
|
350
697
|
A strongly-typed resource class, for looking up localized strings, etc.
|
|
@@ -361,33 +708,33 @@
|
|
|
361
708
|
resource lookups using this strongly typed resource class.
|
|
362
709
|
</summary>
|
|
363
710
|
</member>
|
|
364
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
711
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1011_ReferenceFinalSchema_FullDescription_Text">
|
|
365
712
|
<summary>
|
|
366
713
|
Looks up a localized string similar to The '$schema' property must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
367
714
|
|
|
368
715
|
The SARIF standard was developed over several years and many intermediate versions of the schema were produced. Now that the standard is final, only the OASIS standard version of the schema is valid..
|
|
369
716
|
</summary>
|
|
370
717
|
</member>
|
|
371
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
718
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1013_ProvideRequiredSarifLogProperties_FullDescription_Text">
|
|
372
719
|
<summary>
|
|
373
|
-
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the
|
|
720
|
+
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
374
721
|
|
|
375
722
|
Provide the '$schema' property, which must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
376
723
|
|
|
377
724
|
Provide the 'version' property, which must refer to the the final, OASIS standard version of the SA [rest of string was truncated]";.
|
|
378
725
|
</summary>
|
|
379
726
|
</member>
|
|
380
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
727
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1014_GHAzDOProvideRequiredRunProperties_Error_MissingAutomationDetails_Text">
|
|
381
728
|
<summary>
|
|
382
729
|
Looks up a localized string similar to {0}: This 'run' object does not provide an 'automationDetails' property. This property is required by the {1} service..
|
|
383
730
|
</summary>
|
|
384
731
|
</member>
|
|
385
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
732
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1014_GHAzDOProvideRequiredRunProperties_Error_MissingAutomationDetailsId_Text">
|
|
386
733
|
<summary>
|
|
387
734
|
Looks up a localized string similar to {0}: This 'run' object's 'automationDetails' object does not provide an 'id' value. This property is required by the {1} service..
|
|
388
735
|
</summary>
|
|
389
736
|
</member>
|
|
390
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
737
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1014_ProvideRequiredRunProperties_FullDescription_Text">
|
|
391
738
|
<summary>
|
|
392
739
|
Looks up a localized string similar to The Run object represents a single execution of the specified analysis tool.
|
|
393
740
|
|
|
@@ -395,56 +742,101 @@
|
|
|
395
742
|
|
|
396
743
|
Provide the 'results' array, even if it is empty.
|
|
397
744
|
|
|
398
|
-
Provide the 'automationDetails' property. The automationDetails's 'id' property is required by the
|
|
745
|
+
Provide the 'automationDetails' property. The automationDetails's 'id' property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service..
|
|
399
746
|
</summary>
|
|
400
747
|
</member>
|
|
401
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
748
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1015_ProvideRequiredResultProperties_Error_MissingRuleId_Text">
|
|
402
749
|
<summary>
|
|
403
750
|
Looks up a localized string similar to {0}: This 'result' object does not provide a 'ruleId' value. This property is required by the {1} service..
|
|
404
751
|
</summary>
|
|
405
752
|
</member>
|
|
406
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
753
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1015_ProvideRequiredResultProperties_FullDescription_Text">
|
|
407
754
|
<summary>
|
|
408
755
|
Looks up a localized string similar to The Result object represents an analysis finding and should provide details describing the nature of the problem along with its location in the scan target.
|
|
409
756
|
|
|
410
|
-
Provide the 'ruleId' property, which is the unique identifier of the analysis rule that was violated. This property is required by the
|
|
757
|
+
Provide the 'ruleId' property, which is the unique identifier of the analysis rule that was violated. This property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
411
758
|
|
|
412
|
-
Provide the 'message' property, which is a user-facing explanation of the result occurrence. The message's 'text' property is required by the
|
|
759
|
+
Provide the 'message' property, which is a user-facing explanation of the result occurrence. The message's 'text' property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
413
760
|
|
|
414
761
|
Provide [rest of string was truncated]";.
|
|
415
762
|
</summary>
|
|
416
763
|
</member>
|
|
417
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
764
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1016_ProvideRequiredLocationProperties_FullDescription_Text">
|
|
418
765
|
<summary>
|
|
419
766
|
Looks up a localized string similar to The Location object is important for providing consumers with the location where the result occurred.
|
|
420
767
|
|
|
421
|
-
Provide the 'physicalLocation' property. This property is required by the
|
|
768
|
+
Provide the 'physicalLocation' property. This property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service..
|
|
422
769
|
</summary>
|
|
423
770
|
</member>
|
|
424
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
771
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1017_ProvideRequiredPhysicalLocationProperties_FullDescription_Text">
|
|
425
772
|
<summary>
|
|
426
|
-
Looks up a localized string similar to Provide the 'region' property, along with the appropriate region properties. This property is required by the
|
|
773
|
+
Looks up a localized string similar to Provide the 'region' property, along with the appropriate region properties. This property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
427
774
|
|
|
428
|
-
Provide the 'artifactLocation' property. This property is required by the
|
|
775
|
+
Provide the 'artifactLocation' property. This property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service..
|
|
429
776
|
</summary>
|
|
430
777
|
</member>
|
|
431
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
778
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1018_ProvideRequiredToolProperties_Error_MissingDriverFullName_Text">
|
|
432
779
|
<summary>
|
|
433
780
|
Looks up a localized string similar to {0}: This 'driver' object does not provide a 'fullName' value. This property is required by the {1} service..
|
|
434
781
|
</summary>
|
|
435
782
|
</member>
|
|
436
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
783
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1018_ProvideRequiredToolProperties_FullDescription_Text">
|
|
437
784
|
<summary>
|
|
438
785
|
Looks up a localized string similar to Provide information that makes it easy to identify the name and version of your tool.
|
|
439
786
|
|
|
440
|
-
Provide the 'driver' property. This property is required by the
|
|
787
|
+
Provide the 'driver' property. This property is required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
441
788
|
|
|
442
789
|
Provide the driver's 'name' and 'fullName' properties.
|
|
443
790
|
|
|
444
791
|
Provide the driver's 'rules' array..
|
|
445
792
|
</summary>
|
|
446
793
|
</member>
|
|
447
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
794
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_FullDescription_Text">
|
|
795
|
+
<summary>
|
|
796
|
+
Looks up a localized string similar to When 'run.automationDetails' is present, the four 'azuredevops/pipeline/build/' properties identify the build definition and phase that produced the run..
|
|
797
|
+
</summary>
|
|
798
|
+
</member>
|
|
799
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_MissingBuildDefinitionId_Text">
|
|
800
|
+
<summary>
|
|
801
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' bag does not provide '{2}'. This property is required by the {1} service to identify the build definition..
|
|
802
|
+
</summary>
|
|
803
|
+
</member>
|
|
804
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_InvalidBuildDefinitionId_Text">
|
|
805
|
+
<summary>
|
|
806
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' value for '{2}' is '{3}', which is not a non-zero integer. The {1} service requires a non-zero integer build definition id..
|
|
807
|
+
</summary>
|
|
808
|
+
</member>
|
|
809
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_MissingBuildDefinitionName_Text">
|
|
810
|
+
<summary>
|
|
811
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' bag does not provide '{2}'. This property is required by the {1} service to identify the build definition by name..
|
|
812
|
+
</summary>
|
|
813
|
+
</member>
|
|
814
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_MissingPhaseId_Text">
|
|
815
|
+
<summary>
|
|
816
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' bag does not provide '{2}'. This property is required by the {1} service to identify the build phase..
|
|
817
|
+
</summary>
|
|
818
|
+
</member>
|
|
819
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_InvalidPhaseId_Text">
|
|
820
|
+
<summary>
|
|
821
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' value for '{2}' is '{3}', which is not a non-empty GUID. The {1} service requires a non-empty GUID phase id..
|
|
822
|
+
</summary>
|
|
823
|
+
</member>
|
|
824
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1019_ProvidePipelineProperties_Error_MissingPhaseName_Text">
|
|
825
|
+
<summary>
|
|
826
|
+
Looks up a localized string similar to {0}: The 'automationDetails.properties' bag does not provide '{2}'. This property is required by the {1} service to identify the build phase by name..
|
|
827
|
+
</summary>
|
|
828
|
+
</member>
|
|
829
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1020_ProvideAutomationDetailsIdFormat_FullDescription_Text">
|
|
830
|
+
<summary>
|
|
831
|
+
Looks up a localized string similar to When 'run.automationDetails.id' is present, it must start with the canonical 'azuredevops/pipeline/build/' prefix..
|
|
832
|
+
</summary>
|
|
833
|
+
</member>
|
|
834
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO1020_ProvideAutomationDetailsIdFormat_Error_BadPrefix_Text">
|
|
835
|
+
<summary>
|
|
836
|
+
Looks up a localized string similar to {0}: The 'automationDetails.id' value '{3}' does not start with the expected prefix '{2}'..
|
|
837
|
+
</summary>
|
|
838
|
+
</member>
|
|
839
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO2012_ProvideRequiredReportingDescriptorProperties_FullDescription_Text">
|
|
448
840
|
<summary>
|
|
449
841
|
Looks up a localized string similar to Rule metadata should provide information that makes it easy to understand and fix the problem.
|
|
450
842
|
rule.id
|
|
@@ -454,7 +846,7 @@
|
|
|
454
846
|
Provide the 'name' property, which contains a "friendly name" that helps users see at a glance the purpose of the rule. For uniformity of experience across all tools that produce SARIF, the friendly name should be a single Pascal-case identifier, for example, 'ProvideRuleFriendlyName'..
|
|
455
847
|
</summary>
|
|
456
848
|
</member>
|
|
457
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
849
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GHAzDO2012_ProvideRequiredResultProperties_Error_MissingName_Text">
|
|
458
850
|
<summary>
|
|
459
851
|
Looks up a localized string similar to {0}: This 'reportingDescriptor' object does not provide a 'name' value. This property is required by the {1} service..
|
|
460
852
|
</summary>
|
|
@@ -652,7 +1044,7 @@
|
|
|
652
1044
|
</member>
|
|
653
1045
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.GH1013_ProvideRequiredSarifLogProperties_FullDescription_Text">
|
|
654
1046
|
<summary>
|
|
655
|
-
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the
|
|
1047
|
+
Looks up a localized string similar to The root element of a SARIF log file is a SarifLog object. The properties of this element provide information about the log's schema version as well as an array of analysis runs. These properties are required by the GHAzDO (GitHub Advanced Security for Azure DevOps) service.
|
|
656
1048
|
|
|
657
1049
|
Provide the '$schema' property, which must refer to the final version of the SARIF 2.1.0 schema. This enables IDEs to provide Intellisense for SARIF log files.
|
|
658
1050
|
|
|
@@ -1183,9 +1575,9 @@
|
|
|
1183
1575
|
Looks up a localized string similar to {0}: The 'startLine' property is absent....
|
|
1184
1576
|
</summary>
|
|
1185
1577
|
</member>
|
|
1186
|
-
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.
|
|
1578
|
+
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ServiceName_GHAzDO">
|
|
1187
1579
|
<summary>
|
|
1188
|
-
Looks up a localized string similar to
|
|
1580
|
+
Looks up a localized string similar to GHAzDO (GitHub Advanced Security for Azure DevOps).
|
|
1189
1581
|
</summary>
|
|
1190
1582
|
</member>
|
|
1191
1583
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.RuleResources.ServiceName_GHAS">
|
|
@@ -1474,6 +1866,14 @@
|
|
|
1474
1866
|
example.h. In this case, 'analysisTarget' is example.c, and the result location is in example.h.
|
|
1475
1867
|
</summary>
|
|
1476
1868
|
</member>
|
|
1869
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.OptimizeFileSize.CheckSentinelIndex(System.Int32,System.String,System.String)">
|
|
1870
|
+
<summary>
|
|
1871
|
+
Flag an explicit emission of the SARIF <c>-1</c> "unset index" sentinel
|
|
1872
|
+
(\u00a73.4) when the JSON contains the property literally. The sentinel is
|
|
1873
|
+
semantically equivalent to omitting the property; emitting it bloats the
|
|
1874
|
+
log without changing meaning.
|
|
1875
|
+
</summary>
|
|
1876
|
+
</member>
|
|
1477
1877
|
<member name="P:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.ProvideToolProperties.Id">
|
|
1478
1878
|
<summary>
|
|
1479
1879
|
SARIF2005
|
|
@@ -1690,5 +2090,42 @@
|
|
|
1690
2090
|
<param name="uriKind">The type of the `Uri` in `uriString`.</param>
|
|
1691
2091
|
<returns></returns>
|
|
1692
2092
|
</member>
|
|
2093
|
+
<member name="F:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.SarifValidationSkimmerBase.AIOriginPropertyName">
|
|
2094
|
+
<summary>
|
|
2095
|
+
The well-known run property whose presence (with any non-null/non-empty
|
|
2096
|
+
value) declares that the containing run was produced by an AI emitter.
|
|
2097
|
+
AI-emitted SARIF is stochastic by construction — message text is rendered
|
|
2098
|
+
per-result rather than authored against a table of <c>messageStrings</c>
|
|
2099
|
+
templates, and rule ids ride the <c>NOVEL-</c> / <c>BASE/sub-id</c>
|
|
2100
|
+
convention rather than a fixed tool prefix. Style-class validation rules
|
|
2101
|
+
(e.g. SARIF2002, SARIF2009, SARIF2014, SARIF2015) encode human-authoring
|
|
2102
|
+
guidance whose preconditions don't hold for AI output, so they suppress
|
|
2103
|
+
themselves when this marker is set.
|
|
2104
|
+
|
|
2105
|
+
Correctness-class rules (snippets, hashes, provenance, relative URIs, etc.)
|
|
2106
|
+
must NOT consult this marker — those checks apply uniformly to AI content.
|
|
2107
|
+
</summary>
|
|
2108
|
+
</member>
|
|
2109
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.SarifValidationSkimmerBase.IsAIOriginRun(Microsoft.CodeAnalysis.Sarif.Run)">
|
|
2110
|
+
<summary>
|
|
2111
|
+
Returns true when <paramref name="run"/> declares AI provenance via the
|
|
2112
|
+
<c>ai/origin</c> run property. Any non-null/non-empty value counts; the
|
|
2113
|
+
vocabulary (<c>generated</c>, <c>annotated</c>, <c>synthesized</c>, …)
|
|
2114
|
+
is open by design so AI tooling can self-describe at any granularity.
|
|
2115
|
+
</summary>
|
|
2116
|
+
<exception cref="T:System.ArgumentNullException">
|
|
2117
|
+
<paramref name="run"/> is null. Callers reading AI-origin during rule
|
|
2118
|
+
dispatch should already hold a non-null run; the strict contract makes
|
|
2119
|
+
upstream lifecycle bugs loud rather than masking them as "not AI".
|
|
2120
|
+
</exception>
|
|
2121
|
+
</member>
|
|
2122
|
+
<member name="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.SarifValidationSkimmerBase.IsAIOriginRun">
|
|
2123
|
+
<summary>
|
|
2124
|
+
Instance convenience: reports whether the run currently being visited
|
|
2125
|
+
declares AI provenance. Returns false when there is no current run
|
|
2126
|
+
scope (e.g. an <c>Analyze(SarifLog)</c> dispatch); otherwise defers to
|
|
2127
|
+
<see cref="M:Microsoft.CodeAnalysis.Sarif.Multitool.Rules.SarifValidationSkimmerBase.IsAIOriginRun(Microsoft.CodeAnalysis.Sarif.Run)"/>.
|
|
2128
|
+
</summary>
|
|
2129
|
+
</member>
|
|
1693
2130
|
</members>
|
|
1694
2131
|
</doc>
|