Support SARIF reports

[Staldera (Alan Stalder)]

Hi, I have seen the feature in SonarQube, but is there any plan to support it in SonarCloud as well?

[ganncamp (G Ann Campbell)]

Hi @Staldera

Welcome to the community!

This isn’t available in SonarCloud yet. I would expect it to get there eventually, but I’m not currently aware of any timeline.

 
HTH,
Ann

[Martin_Bednorz]

Hello @Staldera ,

You can follow and provide feedback on this feature via our public SonarCloud roadmap: https://portal.productboard.com/sonarsource/1-sonarcloud/c/329-sarif-report-import . This will help us better understand your needs and the traction in general.

[leonid-deriv]

any updates on supporting uploading SARIF report to SonarCloud?

[Staldera (Alan Stalder)]

I’m also curious about an answer here…Considering the fact that this feature was requested in 2020, and it exists in SonarQube since over a year ago, I’m really curious why this hasn’t been ported to SonarCloud yet?

With the generic issue format changing to something way more complicated to generate with Trivy templates, this becomes an increasingly urgent feature for us. As soon as the previous format is deprecated we’ll either need to invest the effort to generate something that matches the new template (pretty hard with the rule to issue link) or get another product to aggregate code quality.

[Colin]

Hey @leonid-deriv and @Staldera

Just an update, we now support importing SARIF reports in SonarCloud.

SonarCloud can import SARIF files to load external issues

Dear Community, We are thrilled to announce a highly expected feature that has finally arrived on SonarCloud: the ability to import SARIF files to load external issues! This functionality, which has been available on SonarQube for a couple of years, has now been successfully ported to SonarCloud. As in SonarQube, all issues created from a SARIF file are categorized as Vulnerabilities impacting the software quality “Security”. Currently, there is no way to override this default mapping. The sev…