feat: ingest SARIF analyzer evidence (#103)

Author: haasonsaas

.diffscope.yml.example

@@ -156,4 +156,8 @@ paths:
 plugins:
   eslint: true
   semgrep: true
+  secret_scanner: true
+  supply_chain: true
+  rust_compile: true
   duplicate_filter: true
+  sarif_reports: []

README.md

@@ -439,9 +439,15 @@ rule_priority:
 
 # Built-in plugins (enabled by default)
 plugins:
-  eslint: true          # JavaScript/TypeScript linting
-  semgrep: true         # Security-focused static analysis  
-  duplicate_filter: true # Remove duplicate comments
+  eslint: true             # JavaScript/TypeScript linting
+  semgrep: true            # Security-focused static analysis
+  duplicate_filter: true   # Remove duplicate comments
+  secret_scanner: true     # Regex-based secret detection on added lines
+  supply_chain: true       # Dependency manifest risk analysis
+  rust_compile: true       # Rust compile-regression analysis
+  sarif_reports:           # Optional SARIF/code-scanning reports, repo-local only
+    - codeql.sarif
+    - semgrep.sarif
 
 # Global exclusions
 exclude_patterns:

src/config.rs

@@ -771,6 +771,10 @@ pub struct PluginConfig {
     /// Rust compile-regression analysis for high-confidence struct initializer removals.
     #[serde(default = "default_true")]
     pub rust_compile: bool,
+
+    /// SARIF/code-scanning report paths to ingest as analyzer evidence.
+    #[serde(default)]
+    pub sarif_reports: Vec<String>,
 }
 
 impl Default for PluginConfig {
@@ -782,6 +786,7 @@ impl Default for PluginConfig {
             secret_scanner: true,
             supply_chain: true,
             rust_compile: true,
+            sarif_reports: Vec::new(),
         }
     }
 }

src/plugins/builtin/mod.rs

@@ -2,13 +2,15 @@ mod duplicate_filter;
 mod eslint;
 mod path_utils;
 mod rust_compile;
+mod sarif;
 mod secret_scanner;
 mod semgrep;
 mod supply_chain;
 
 pub use duplicate_filter::DuplicateFilter;
 pub use eslint::EslintAnalyzer;
 pub use rust_compile::RustCompileAnalyzer;
+pub use sarif::SarifAnalyzer;
 pub use secret_scanner::SecretScanner;
 pub use semgrep::SemgrepAnalyzer;
 pub use supply_chain::SupplyChainAnalyzer;