Add SARIF (Static Analysis Results Interchange Format) output support

[Hmanbo]

Feature

Add support for SARIF (Static Analysis Results Interchange Format) output format to mypy, similar to the existing --output=json option.

Pitch

SARIF is an OASIS standard format for static analysis results that is widely supported by modern CI/CD platforms and security tools:

• GitHub Advanced Security natively ingests SARIF files for code scanning alerts
• Azure DevOps supports SARIF for displaying security and code quality results
• GitLab can process SARIF reports for vulnerability tracking
• Many other security and code quality platforms (SonarQube, CodeQL, etc.) support SARIF

Other Python type checkers like Pyre already support SARIF output. Adding this to mypy would:

1. Improve integration with GitHub/Azure/GitLab security features
2. Make it easier to use mypy in enterprise CI/CD pipelines
3. Provide a standardized foundation for richer diagnostics supported by SARIF
4. Enable consumption by security tools that require standardized formats

Example Usage

# Generate SARIF output
mypy myproject/ --output=sarif > results.sarif

# Upload to GitHub Code Scanning (requires gzip + base64 encoding)
gzip -c results.sarif | base64 -w0 > results.sarif.gz.b64
gh api /repos/owner/repo/code-scanning/sarifs --method POST \
  --field commit_sha="$(git rev-parse HEAD)" \
  --field ref="refs/heads/main" \
  --field sarif="@results.sarif.gz.b64"

Implementation Notes

The implementation could likely build on the existing output formatter infrastructure:

1. Add a new SARIFFormatter class in mypy/error_formatter.py extending ErrorFormatter
2. Add "sarif" to the OUTPUT_CHOICES dictionary
3. Implement the SARIF v2.1.0 JSON schema

The MypyError class already provides the necessary diagnostic data (file path, line, column, error code, message, severity). Note that SARIF requires aggregating results into a single document structure rather than line-by-line output like JSON, which may require some adjustments to the formatter interface.

Related Issues

• Support more output formats #10816 (closed) - discussed multiple output formats including SARIF in comments
• Add a new output format option to print errors as GitHub Actions Workflow commands  #17612 - GitHub Actions workflow commands format (similar motivation)
• Include summary in --output=json #20212 - Include summary in JSON output

References

• SARIF specification
• GitHub SARIF support documentation
• Microsoft SARIF Tutorials