Verification · Finding validation · Finding deduplication
Consolidation
Merge a cluster into one finding that keeps all evidence.
How to build it
- Merge each cluster into one finding that lists every source rule, file and run.
- Keep the evidence of each merged finding in a locations array.
- Keep the original findings linked so reviewers can audit the merge.
Signals in a repository
- A sarif-tools merge step or a script that merges SARIF runs.
- A SARIF result with multiple locations for one problem.
- A merge step between the scanner and the upload step in CI.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.