# How to Interpret SARIF Output for CI/CD Integration with NVIDIA SkillSpector

> Effectively interpret SARIF output from NVIDIA SkillSpector for CI CD integration. Trigger automated build failures and security gates with standard JSON parsing.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-20

---

**SkillSpector generates validated SARIF 2.1.0 reports that map security findings directly to CI/CD alert levels, enabling automated build failures and security gates through standard JSON parsing.**

NVIDIA SkillSpector analyzes code for security vulnerabilities and outputs results in the **Static Analysis Results Interchange Format (SARIF)**. Understanding how to interpret SARIF output for CI/CD integration allows you to automate security scanning in GitHub Actions, Azure Pipelines, and other DevOps platforms without custom parsers.

## Understanding SkillSpector's SARIF Schema

SkillSpector implements the **SARIF 2.1.0** standard, producing JSON-compatible reports that follow the official schema. In [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py), the `_build_sarif` function constructs the document by converting internal `Finding` objects into standardized SARIF structures.

### Core SARIF Structure

The generated SARIF document contains:

- **`$schema`**: Points to the official SARIF 2.1.0 schema URL
- **`runs`**: Array containing a single run object (one SkillSpector invocation)
- **`tool.driver`**: Identifies SkillSpector name and version for traceability
- **`results`**: Array of finding objects, each representing a detected security issue

### The SarifLog Model

The underlying data structure is defined in [`src/skillspector/sarif_models.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/sarif_models.py) as the `SarifLog` Pydantic model. This model validates the final output through `validate_sarif_report` before serialization, ensuring CI/CD systems receive schema-compliant JSON.

## Mapping Severity Levels for CI/CD Alerts

SkillSpector maps its internal severity bands to SARIF's `level` field for standardized CI/CD consumption:

- **CRITICAL/HIGH** → `error` (fails builds)
- **MEDIUM** → `warning` (visible alerts)
- **LOW** → `note` (informational)

This mapping occurs in the report generation logic within `_build_sarif`, allowing CI/CD platforms to render appropriate visual badges and set failure thresholds without custom parsing logic.

## Locating Issues in Source Code

Each result entry contains precise location data through nested objects:

- **`ruleId`**: The SkillSpector analyzer identifier (e.g., `TP001`, `ASV02`)
- **`locations`**: Array containing `physicalLocation` objects
  - **`artifactLocation.uri`**: Relative file path
  - **`region`**: Optional line numbers (`startLine`, `endLine`)

This structure enables CI/CD systems to annotate pull requests with exact file and line references.

## CI/CD Integration Examples

### GitHub Actions Workflow

Upload SkillSpector results to GitHub Code Scanning using the official CodeQL action:

```yaml
name: SkillSpector Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run SkillSpector
        run: |
          pip install skillspector
          skillspector scan . --output-format sarif > sarif.json
      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: sarif.json

```

### Azure Pipelines Integration

Publish results as test artifacts using the `PublishTestResults` task:

```yaml
steps:
- script: |
    pip install skillspector
    skillspector scan . --output-format sarif > $(Build.ArtifactStagingDirectory)/sarif.json
  displayName: Run SkillSpector

- task: PublishTestResults@2
  inputs:
    testResultsFormat: 'Sarif'
    testResultsFiles: '$(Build.ArtifactStagingDirectory)/sarif.json'
    mergeTestResults: true

```

### Parsing SARIF in Python

Extract findings programmatically for custom CI/CD logic:

```python
import json
from pathlib import Path

sarif_path = Path("output/sarif.json")
sarif = json.loads(sarif_path.read_text())

for run in sarif["runs"]:
    for result in run["results"]:
        rule = result["ruleId"]
        level = result["level"]
        loc = result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"]
        region = result["locations"][0]["physicalLocation"].get("region", {})
        start = region.get("startLine", "?")
        end = region.get("endLine", start)
        print(f"{rule}: {level.upper()} in {loc}:{start}-{end}")

```

### Generic CI/CD Upload

For platforms with SARIF endpoints:

```bash

# Generate SARIF

pip install skillspector
skillspector scan . --output-format sarif > sarif.json

# Upload to CI endpoint

curl -X POST -H "Content-Type: application/json" \
     --data @sarif.json \
     https://ci.example.com/api/upload-sarif

```

## Summary

- SkillSpector generates **SARIF 2.1.0** output through the `_build_sarif` function in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py)
- The `SarifLog` model in [`src/skillspector/sarif_models.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/sarif_models.py) validates results against the official schema using `validate_sarif_report`
- Severity maps to standard `level` values (`error`, `warning`, `note`) for immediate CI/CD consumption
- Each result contains `ruleId` and `physicalLocation` data for precise file and line identification
- Validated SARIF output works natively with GitHub Actions, Azure Pipelines, and GitLab SAST without transformation

## Frequently Asked Questions

### What SARIF version does SkillSpector use?

SkillSpector implements **SARIF 2.1.0** (RTM.4), referencing the official schema at `https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.4.json`. This version is the de-facto standard for static analysis tools and is supported by all major CI/CD platforms including GitHub Code Scanning and Azure DevOps.

### How does SkillSpector map internal severity to SARIF levels?

The conversion happens in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py). **Critical** and **High** severity findings map to `error`, **Medium** to `warning`, and **Low** to `note`. This mapping allows CI/CD systems to apply standard failure thresholds without custom configuration.

### Where is the SARIF generation logic located in the SkillSpector codebase?

The core logic resides in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) within the `_build_sarif` method, which converts internal `Finding` objects (defined in [`src/skillspector/models.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/models.py)) into SARIF-compliant structures. The Pydantic models for the SARIF schema are defined in [`src/skillspector/sarif_models.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/sarif_models.py).

### Can SkillSpector SARIF output trigger automated build failures?

Yes. Because SkillSpector emits valid SARIF with appropriate `level` fields, CI/CD platforms like GitHub Actions and Azure DevOps automatically fail pipelines when `error` level results are present. You can also parse the JSON programmatically using the `results` array to implement custom gating logic based on specific `ruleId` patterns or severity thresholds.