diff --git a/.github/scripts/sarif_summary.py b/.github/scripts/sarif_summary.py
new file mode 100644
index 00000000..a741a429
--- /dev/null
+++ b/.github/scripts/sarif_summary.py
@@ -0,0 +1,150 @@
+"""Summarizes SARIF static analysis results as Markdown and, given the base's results, fails on new findings."""
+import argparse
+import collections
+import json
+import pathlib
+import re
+import sys
+import urllib.parse
+import urllib.request
+
+MAX_LISTED = 50
+GATED_LEVELS = ("error", "warning")
+Finding = collections.namedtuple("Finding", "rule level description path line column message")
+
+
+def sarif_files(arguments):
+ """Returns the SARIF files named by the arguments, expanding directories."""
+ files = []
+ for argument in arguments:
+ path = pathlib.Path(argument)
+ files.extend(sorted(path.rglob("*.sarif")) if path.is_dir() else [path] if path.is_file() else [])
+ return files
+
+
+def relative_path(uri, root):
+ """Returns the path of a SARIF artifact URI, relative to root when it lies inside it."""
+ parsed = urllib.parse.urlparse(uri)
+ path = urllib.request.url2pathname(parsed.path) if parsed.scheme == "file" else urllib.parse.unquote(uri)
+ try:
+ return (root / path).resolve().relative_to(root.resolve()).as_posix()
+ except (ValueError, OSError):
+ return pathlib.PurePath(path).as_posix()
+
+
+def artifact_uri(location, base_ids):
+ """Returns the artifact URI of a SARIF location, resolved against its uriBaseId when the run defines it."""
+ uri = location.get("uri", "")
+ base = base_ids.get(location.get("uriBaseId"), {}).get("uri")
+ return urllib.parse.urljoin(base, uri) if base else uri
+
+
+def findings(files, root):
+ """Yields every distinct finding in the SARIF files, with paths relative to root."""
+ seen = set()
+ for file in files:
+ for run in json.loads(file.read_text(encoding="utf-8-sig")).get("runs", []):
+ rules = {rule.get("id"): rule for rule in run.get("tool", {}).get("driver", {}).get("rules", [])}
+ base_ids = run.get("originalUriBaseIds", {})
+ for result in run.get("results", []):
+ rule_id = result.get("ruleId") or result.get("rule", {}).get("id", "unknown")
+ rule = rules.get(rule_id, {})
+ physical = (result.get("locations") or [{}])[0].get("physicalLocation", {})
+ finding = Finding(
+ rule_id,
+ result.get("level") or rule.get("defaultConfiguration", {}).get("level", "warning"),
+ rule.get("shortDescription", {}).get("text")
+ or rule.get("fullDescription", {}).get("text") or rule.get("helpUri", ""),
+ relative_path(artifact_uri(physical.get("artifactLocation", {}), base_ids), root),
+ physical.get("region", {}).get("startLine"),
+ physical.get("region", {}).get("startColumn"),
+ (result.get("message", {}).get("text") or "").split("\n")[0],
+ )
+ # The same finding in a shared header is reported once per source file that includes it.
+ if finding not in seen:
+ seen.add(finding)
+ yield finding
+
+
+def fingerprint(finding):
+ """Returns what identifies a finding across commits: rule, file and message, with numbers masked."""
+ return finding.rule, finding.path, re.sub(r"\d+", "#", finding.message)
+
+
+def cell(text):
+ """Escapes text for a Markdown table cell."""
+ return str(text).replace("|", "\\|").replace("\n", " ")[:160]
+
+
+def where(finding):
+ """Returns 'path:line', or the path alone when the finding has no line."""
+ return f"{finding.path}:{finding.line}" if finding.line else finding.path
+
+
+def print_summary(title, rows):
+ """Prints the findings per rule and level, then the first findings with their location."""
+ print(f"### {title}: {len(rows)} finding{'s' if len(rows) != 1 else ''}\n")
+ if not rows:
+ return
+ counts = collections.Counter((row.rule, row.level, row.description) for row in rows)
+ print("| Rule | Level | Count | Description |\n|---|---|---|---|")
+ for (rule, level, description), count in sorted(counts.items(), key=lambda item: (-item[1], item[0])):
+ print(f"| {cell(rule)} | {level} | {count} | {cell(description)} |")
+ print(f"\nFirst {min(MAX_LISTED, len(rows))} findings
\n")
+ print("| Location | Rule | Message |\n|---|---|---|")
+ for row in sorted(rows, key=lambda row: (row.path, row.line or 0))[:MAX_LISTED]:
+ print(f"| {cell(where(row))} | {cell(row.rule)} | {cell(row.message)} |")
+ print("\n