Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Merged SARIF log drops rule descriptions

オープン
  • 何か問題がありますか？
#207 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@SizzleUnrlsd がすでに取り組んでいます。

2026年10月19日 から。

評価

この issue はまだ評価されていません。

説明

enhancement severity/minor

Observed

In the merged SARIF log written by --sarif-format, each rule in tool.driver.rules carries only its id:

ctrace --sarif-format --invoke ctrace_stack_analyzer,cppcheck --input demo.c --report-file r.sarif

"rules": [{"id": "StackBufferOverflow"}]

There is no shortDescription, fullDescription, help or helpUri. A SARIF consumer (GitHub code scanning, an IDE, an agent integration) can show a finding's message but cannot explain the rule behind it.

Cause

src/Process/Tools/Sarif.cpp:321 builds rules from the unified diagnostic model (#93: "rules collected from the diagnostics"), and Diagnostic (include/Process/Tools/Diagnostic.hpp) has no field for rule metadata, so there is nothing to write.

The text is available for some tools:

Tool Rule metadata today
coretrace-concurrency-analyzer Full catalog in src/internal/diagnostics/diagnostic_catalog.cpp (title, description, CWE title), already written to its own SARIF by report_renderer.cpp, but lost in the merged log
ctrace_stack_analyzer None: its native SARIF writer sets shortDescription to the rule id (ReportSerialization.cpp:431)
coretrace-python-analyzer None: shortDescription is the rule id (reporters/sarif.py:107)
cppcheck, flawfinder, tscancode Not checked

Consequences

  • GitHub code scanning shows the rule id as the rule's name and no help text.
  • Tools built on the merged log (a local MCP server's explain_rule, IDE hovers) need their own rule catalog, which would drift from the analyzers.

Proposed resolution (to be discussed)

  • Carry rule metadata alongside the diagnostics, for example a per-tool rule table (id → title, description, help URI) that tool implementations fill when the tool provides it, rendered into rules by Sarif.cpp.
  • First step: the concurrency analyzer, whose catalog already exists and is linked in process.
  • The stack and Python analyzers would need their own catalogs; that is work in their repositories and can come later.
  • Without metadata, keep writing {"id": ...} as today.

Open question: is this worth doing before 1.0, given that the SARIF format is among the interfaces to freeze (ROADMAP, theme 1)? Adding rules fields is additive and should not change the coretrace/v1 fingerprints.

Acceptance

  • Unit test: a diagnostic whose tool provides metadata renders shortDescription and fullDescription in its rule; one without keeps {"id": ...}.
  • ctest: --invoke coretrace-concurrency-analyzer on a racy fixture writes the rule's title and description to the merged log.
  • coretrace/v1 fingerprints are unchanged for the existing fixtures.
主要言語
C++
スター
5
フォーク
4
平均マージ
2時間 13分
マージ済み PR（30日）
76

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

CoreTrace/coretrace のほかの issue

CoreTrace/coretrace の issue をすべて見る

似ている issue

C++ の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。