Spectral-sarif is a Node based tool for transforming spectral json output to sarif format.
The purpose is for importing the spectral output into static analysis tools such as SonarQube for the tracking of spectral issues.
npm install spectral-sarif
To see a list of options run
npx spectral-sarif
Usage: spectral-sarif [options] <filename>
Options:
--help Show help [boolean]
--version Show version number [boolean]
-o, --output Output filename [string]
-r, --root Root directory [string]
Not enough non-option arguments: got 0, need at least 1
Spectral-cli must be first run with the -f json -o out.json commandis to produce a json output of the spectral errors and warnings
see https://www.npmjs.com/package/@stoplight/spectral for more information about spectral. Its an excellent tool for analysing OpenAPI documents.
To run spectral lint generating json output for spectral-sarif to read you need to run it like this:
spectral -f json -o out.json lint openapi.yaml
Then you can now run spectral-sarif -o out.sarif out.json, it simply transforms the spectral json output into sarif format
spectral-sarif -o out.sarif out.json
Now running sonar-scanner with the following properties
sonar.host.url=<your sonarqube url>
sonar.projectKey=spectral-sarif
sonar.sources=.
sonar.login=<your token>
sonar.sarifReportPaths=./out.sarif
For sonarqube the pyhsical location must be relative to the sonar.source directory in order for sonarqube to see the code itself, where as spectral will supply a full path to the openapi.json/yaml file,
For this we have added a -r option that can be added which will stream the leading part of the path.
spectral-sarif -r c:\source\myproject -o out.sarif out.json
This root directory should be the path to your sonar-project.properties file.
NOTE: SonarCloud does not support sarifReportPaths (in the same way as SonarQube does)