Generate report file from analysis.

[Vyom-Yadav]

Currently, Checker Framework outputs all the warnings and errors to the console.

When using a build system like maven or gradle, the order of output can vary (see known bug with maven).

Checker Framework should generate a parsable report file which can be easily extended to create universal suppression systems, etc.

Currently, at Checkstyle, we use a custom suppression model built with groovy, which parses the output and checks the .xml suppression file.

[msridhar]

If / when someone has cycles to work on this, this Error Prone issue / discussion might be relevant:

google/error-prone#3766

In particular @tbroyer prototyped a relatively non-intrusive way to serialize Error Prone warnings:

google/error-prone#3766 (comment)

A similar approach may work here.

[mernst]

I was thinking of just defining a new subclass of Messager, which could be done within the Checker Framework.

[mernst]

A few notes for anyone who wants to take up this project:

• The SARIF output format is the best choice.
• There are Java bindings in Maven Central; see https://github.com/Contrast-Security-OSS/java-sarif
• It would be better for SARIF to be supported by the build tool or by javac, but an implementation in the Checker Framework would fill the gap until that time comes.

[Gaoyan1999]

Hi! I’ve implemented a POC version of SARIF report generation for the Checker Framework, following the SARIF 2.1.0 specification and using the java-sarif library. I’d really appreciate any feedback or suggestions on the approach. Thanks!

See PR: (#7408)

[Ahmed-Sobh77]

could i work in this issues?

[Gaoyan1999]

could i work in this issues?

I think you could pick another one, since I've already submit a PR wating for code review. :)

[Ahmed-Sobh77]

@Gaoyan1999 thanks pro