I'd like to make the case again for the existing JSON-based standard:Static Analysis Results Interchange Format (SARIF)

While that does not preclude support for a custom JSON format as well, perhaps if mypy were to support SARIF, there would be no need for a custom format?

Pros of SARIF:

• There is no need to reinvent the wheel.

• Can already integrate with existing tools likeGitHub code scanning, Visual Studio, VS Code

• Every IDE shouldn't have to implement its own mypy-specific integration. This is exemplified by the situation in IntelliJ IDEA/PyCharm: there aretwo 3rd party mypy-specific plugins, both of which have major problems that aren't getting fixed. [1]

  Clearly the momentum isn't there to provide good mypy-specific IDE integrations. Adding mypy support for SARIF, and letting IDEs take care of parsing SARIF and implementing a good UI on top, seems like a far more sustainable option.

Cons:

• SARIF is clearly infected with "design by committee", the data structures are verbose and deeply nested. However, advanced features are optional, a minimal implementation is straightforward, see example below.
• No streaming output; all results would have to be collected before the JSON output can be serialized.

[1] The plugin ratings are 3.4 and 2.9 out of 5 😖https://plugins.jetbrains.com/search?search=mypy

{"version":"2.1.0","$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json","runs": [    {"tool": {"driver": {"name":"mypy","version":"0.910"        }      },"results": [        {"ruleId":"assignment","level":"error","message": {"text":"Incompatible types in assignment (expression has type\"str\", variable has type\"int\")"          },"locations": [            {"physicalLocation": {"artifactLocation": {"uri":"mytest.py"                },"region": {"startLine":2,"startColumn":4                }              }            }          ]        },        {"ruleId":"name-defined","level":"error","message": {"text":"Name\"z\" is not defined"          },"locations": [            {"physicalLocation": {"artifactLocation": {"uri":"mytest.py"                },"region": {"startLine":3,"startColumn":4                }              }            }          ]        }      ]    }  ]}

+1 for SARIF format, let's use a common format instead of a mypy custom one ! :)

I'm willing to turn it into SARIF (basing it on the json snippet provided by@intgr), if that's what I need to get this into mypy 😄

@ethanhs@TH3CHARLie what do you think?

After sitting on it a little, I feel that there's room for more than one machine-readable format. The simpler json-line-based format is probably better for simple tools that only care about mypy. I'm willing to implement the SARIF part myself.

But I shouldn't be the one to decide that, I'm just an occasional lurker here. No mypy developers have chipped in yet.

I'm just a tourist here, but i'm currently activating SARIF output for all linters ofMegaLinter, and having native SARIF output is a great benefit for linters ^^ ( + the Github CodeQL that natively understands SARIF format ^^ )

Some other python linters already have SARIF output, likebandit , maybe there is some code to reuse to manage the format ?

@nvuillam this PR introduces an ErrorFormatter class. By the time this PR is finalized, even if it doesn't use SARIF you will be able to define your own ErrorFormatter class in a plugin probably, and tell it to output the SARIF format, it'll be really easy.

Pylint has the same setup.

@tusharsadhwani thank but... I don't have the bandwidth to implement SARIF output on all linters that do not manage it yet 😅

I think one property that machine-readable formats should have is: if one error causes multiple lines of output, then that should appear as one result item rather than multiple.

So for example withmypy --show-error-context

_local/multi_error.py: note: In function "foo":_local/multi_error.py:5:9: error: No overload variant of "get" of "Mapping" matches argument type "str"  [call-overload]_local/multi_error.py:5:9: note: Possible overload variants:_local/multi_error.py:5:9: note:     def get(self, key: Any) -> Any_local/multi_error.py:5:9: note:     def [_T] get(self, key: Any, default: Union[Any, _T]) -> Union[Any, _T]Found 1 error in 1 file (checked 1 source file)

should maybe be output as

{"file":"_local/multi_error.py","line":5,"column":8,"severity":"error","context":"In function\"foo\":","message":"No overload variant of\"get\" of\"Mapping\" matches argument type\"str\"","hint":"Possible overload variants:\n    def get(self, key: Any) -> Any\n    def [_T] get(self, key: Any, default: Union[Any, _T]) -> Union[Any, _T]","code":"call-overload"}

But again, maybe that shouldn't be a blocker for this PR, getting machine-readable output can be useful even when findings aren't accurately grouped.

The negative line/column numbers right now seem awkward though:

{"file":"_local/multi_error.py","line":-1,"column":-1,"severity":"note","message":"In function\"foo\":","code":null}

That's definitely a bug.

The mypy code that generates this output was ridiculously coupled. I'll take a look at if this can be fixed.

It has been many months as the project has hoped for a best solution over an existing solution. Can we merge this and accept future improvement using--output serif if someone comes along and implements it?

@intgr I did it properly this time. Hints should be fixed now.

--output json option gets ignored after some usage withmypy.api.run_dmypy . Pasing json option to dmypy CLI worked fine, but invoking run_dmypy function in a Python script returns plain string output after some usage. Can someone help me troubleshoot this?

@sehyun-hwang sure thing. If you could provide a reproducible example I can look into it right away.

@tusharsadhwani Thank you! I tried linting jobs in a container, and was unable to reproduce it. The problem occurs only when my IDE invokes dmypy, so I'm suspecting this has to do with concurrent execution. Do you see a chance where--output json option gets ignored when multiple clients are connected, or clients are threaded or running in a child process?

I found that the first file linted output a json format, but from the second one it goes back to the string format. Can you try to reproduce this?

centos@www /m/tax-automation (99-basic-types) [1]> dmypy check -- batch_api.py{"file": "batch_api.py", "line": 5, "column": 0, "message": "Cannot find implementation or library stub for module named \"LAMBDA_CONFIG\"", "hint": "See https://mypy.readthedocs.io/en/stable/running_mypy.html#missing-imports", "code": "import"}{"file": "batch_api.py", "line": 6, "column": 0, "message": "Cannot find implementation or library stub for module named \"common.utils\"", "hint": "", "code": "import"}centos@www /m/tax-automation (99-basic-types) [1]> dmypy check -- foo.pyfoo.py:2: error: Name "bar" is not definedfoo.py:5: error: Argument 1 to "foo" has incompatible type "str"; expected "int"```

@sehyun-hwang This seems like a dmypy bug. It seems that dmypy ignores cli flags or config file flags in certain cases.

Here's a file structure:

$tree..├── a.py├── b.py└── mypy.ini

Andmypy.ini contains the following:

[mypy]strict = True

a.py andb.py both contain:

deffoo():pass

This waymypy a.py won't show errors butmypy --strict a.py will.
When alternating betweendmypy check a.py anddmypy check b.py, at some pointdmypy stops showing strict output. For the same reason it might be forgetting the--output flag being set as well.

#11396 (comment)

@intgr Could you take a look at the comment by@tusharsadhwani ?

I'm afraid I can't help much with this. Just to clarify, I think my name shows up in the "reviewers" list only because I left a code comment about this PR earlier. I'm not a maintainer or reviewer in an official capacity and I don't have much knowledge of mypy's internals.

I'm just a user interested in consuming structured output from mypy (and potentially adding SARIF support later on). That's why I shared my opinions in this comment thread.

Yeah, the scope of this project has nothing to do with integrating various git servers' CI runners. That would be a rabbit hole of tech debt.

I'm not sure we'd accept support for other output formats in mypy itself, since we'd take on additional maintenance load. If this PR is merged, such formats could be supported in external tools that consume mypy's JSON output.

If mypy will only support 1 machine-parsable output format, then please choose a standard or de facto recognized format. Don't create yet another tool-specific mypy output format that everybody then has to write another set of adapters for.

For example, tools already exist to convert SARIF into GitLab "CodeQuality" reportshttps://gitlab.com/ahogen/sarif-to-codequality.

According tomypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅

FWIW I prefer current output as it is leaner and it's trivial for any tool to translate it to SARIF (pyright rejected the idea of adding SARIF forthe same reason).

But I will add a SARIF formatter in the same PR if maintainers agree to it.

FWIW I prefer current output as it is leaner and it's trivial for any tool to translate it to SARIF (pyright rejected the idea of adding SARIF forthe same reason).

which I just commented.

But I will add a SARIF formatter in the same PR if maintainers agree to it.

Otherwise it will require yet another converter-to-sarif tool. There is plenty of support already in IDEs, linters aggregators, and other analysis tools. If you think that SARIF could be leaner, then I do propose you to participate in its committee (I'm not being cinic, I mean it, you may have a good idea), make your proposal, and discuss it. That would be the right approach so the whole static analysis community gets benefited.

If I merge this PR, I take on the responsibility (at least in my mind) for triaging and reviewing future fixes to this area. I'm OK with doing that for this simple JSON format; I'm not OK with having to maintain compliance with the external SARIF spec. If another maintainer wants to add SARIF support, I'd welcome it, since clearly it will help some users, but I'm not interested in taking ownership of it.

According tomypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅

I think this is close to ready.

We'll also want to document the JSON format in the mypy documentation, but that can wait for a separate PR.

@dgutson Thanks for bringing this PR to my attention again :)

Otherwise it will require yet another converter-to-sarif tool

I just made and verified a scipt to run mypy with SARIF output, dropping it here incase it is useful to someone:https://gist.github.com/tusharsadhwani/5fd7a3c32d73f10fcb86e8deac4b60cf

@dgutson Thanks for bringing this PR to my attention again :)

Otherwise it will require yet another converter-to-sarif tool

I just made and verified a scipt to run mypy with SARIF output, dropping it here incase it is useful to someone:https://gist.github.com/tusharsadhwani/5fd7a3c32d73f10fcb86e8deac4b60cf

could you please add it to the source tree? Otherwise it will be lost in a PR comment :)
Moreover, adding it as part of this PR would make sense for me.

I think Jelle has made his stance clear. I'd rather not have this feature delayed potentially a few more months over that.

Although I don't mind SARIF support, I'm not particularly looking for it, and neither are the maintainers super stoked about it yet, it seems.

At this moment I think it'd be best to make a different issue for SARIF support. Feel free to use the gist as a basis for the PR against that issue.

@JelleZijlstra sorry for always being that person, but is this released?

Was just working on some automated tests for Strawberry and having JSON output would be make it much easier (we use that for pyright as well)

@JelleZijlstra sorry for always being that person, but is this released?

not yet released, but you can track the progress of the next release in#17285. It should include this PR.

General tip: you can click on the commit page to see whether a commit has been included in a release. In this case, the commit (35fbd2a) shows no releases. A random earlier commit (304997b) shows that the commit is included in a number of releases:

Nice, would it be possible to have mypy write this to a file (and otherwise retain human-readable output)?

Or, have this JSON output format work like the other 'reports' that MyPy provides?

@x0f0 what's the use case?