This PR implements a new sarif-splitter plugin that addresses the need to split large SARIF files into smaller, categorized files for better organization and to overcome GitHub Advanced Security upload restrictions.

Problem Solved

Large SARIF files can exceed GitHub's upload size limits and make it difficult to organize security alerts effectively. The new splitter plugin enables teams to:

• Split large SARIF files into manageable chunks
• Organize alerts by application areas (tests, frontend, backend, etc.)
• Prioritize security reviews by severity levels
• Improve dashboard filtering and search capabilities

Key Features

Path-Based Splitting

Split alerts based on file path patterns using glob matching:

python -m sariftoolkit --enable-splitter --split-by-path --language python --sarif results.sarif

Default path categories:

• Tests: **/test/**, **/tests/**, **/*test*
• App: **/web/**, **/api/**, **/src/**, **/app/**

Severity-Based Splitting

Split alerts by security severity levels automatically extracted from SARIF rule properties:

python -m sariftoolkit --enable-splitter --split-by-severity --language python --sarif results.sarif

Severity mapping:

• Critical: security-severity ≥ 9.0
• High: security-severity 7.0-8.9
• Medium: security-severity 4.0-6.9
• Low: security-severity < 4.0

Single Splitting Method Restriction

The plugin enforces that only one splitting method can be used at a time. Users must choose either --split-by-path OR --split-by-severity, not both, to ensure focused and predictable splitting behavior.

GitHub Advanced Security Integration

Each split SARIF file includes proper runAutomationDetails.id categories following GitHub's conventions:

• Path-based: /language:python/category:Tests, /language:python/filter:none
• Severity-based: /language:python/severity:Critical, /language:python/severity:High, /language:python/severity:Medium, /language:python/severity:Low

Summary Output Table

The plugin provides a comprehensive summary table showing before/after views:

• Original SARIF file names and alert counts
• Generated split files with their categories and alert counts
• Totals verification to ensure no alerts are lost during splitting

Configurable Rules

Custom splitting rules via JSON configuration files:

{
  "path_rules": [
    {
      "name": "Frontend", 
      "patterns": ["**/web/**", "**/*.js", "**/*.jsx"]
    },
    {
      "name": "Backend",
      "patterns": ["**/api/**", "**/*.py", "**/*.java"] 
    }
  ]
}

Technical Implementation

SARIF Model Enhancement

• Added AutomationDetailsModel to support GitHub Advanced Security categories
• Enhanced RunsModel to include automationDetails field

Robust Property Access

The plugin handles various SARIF property formats for security-severity extraction:

# Handles multiple property name variations
security_severity = (props.get('security-severity') or 
                     props.get('security_severity') or
                     props.get('securitySeverity'))

No Alert Loss Guarantee

All alerts are preserved through fallback categories:

• Unmatched file paths → /language:<lang>/filter:none
• Unmatched severities → /language:<lang>/severity:Others

Usage Examples

Basic splitting (single method only):

# Split by severity levels only
python -m sariftoolkit --enable-splitter \
  --split-by-severity \
  --language javascript --sarif scan-results.sarif \
  --output ./categorized-results

Custom configuration:

python -m sariftoolkit --enable-splitter \
  --split-by-path --language java \
  --path-config custom-paths.json \
  --sarif large-scan.sarif

Bug Fixes

This PR also fixes an existing dataclass configuration bug that was preventing the toolkit from running:

# Before (caused ValueError)
relativepaths: PluginConfig = PluginConfig("RelativePaths", "...")

# After (uses field with default_factory)  
relativepaths: PluginConfig = field(default_factory=lambda: PluginConfig("RelativePaths", "..."))

Testing

The implementation has been thoroughly tested with:

• Unit Tests: 6 comprehensive test methods covering all functionality with proper cleanup
• Real SARIF Files: Tested with input-example.sarif and comprehensive test files
• Alert Distribution Validation: Verified correct categorization across Critical (3), High (4), Medium (3), Low (2) severity levels
• Category Validation: Confirmed proper runAutomationDetails.id formatting for GitHub Advanced Security
• Summary Output: Validated before/after table shows correct file names, alert counts, and categories
• Single Method Restriction: Verified plugin rejects multiple splitting methods with clear error messages
• Security Analysis: Passed CodeQL analysis and dependency vulnerability checks

All generated SARIF files maintain complete metadata while properly categorizing alerts for improved dashboard organization with zero alert loss.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.