Introduce --format flag to conditionally generate SARIF report

[nureka-rodrigo]

Purpose

Fixes: #68

Approach

This PR adds support for the Static Analysis Results Interchange Format (SARIF) in addition to the existing JSON output. The implementation preserves backward compatibility and introduces SARIF as an alternative reporting option for improved integration with external development tools.

A new convertIssuesToSarifString method has been implemented to generate SARIF-compliant output by mapping internal Issue objects to the SARIF schema, including sections such as runs, driver, rules, and results. Severity levels defined by RuleKind are translated to their SARIF equivalents using a helper method, and detailed source location data—including line and column positions—is included in the output.

The Gson library continues to be used for pretty-printing in both JSON and SARIF formats. Output format selection is handled via a new --format flag in the CLI, with input validation to restrict accepted values. Both console and file output workflows support the new format, with JSON remaining the default when no format is specified.

Check List

• Read the Contributing Guide
• Added necessary tests
  • Unit Tests
  • Integration Tests

[SasinduDilshara]

Suggested change

	bal scan --format=sarif
	$ bal scan --format=sarif

[Copilot]

Pull Request Overview

This PR introduces SARIF (Static Analysis Results Interchange Format) support as an alternative to the existing JSON output format. The implementation adds a new --format flag to the CLI that accepts either "json" or "sarif" values, with JSON remaining the default format to preserve backward compatibility.

Key changes include:

• Added ReportFormat enum to handle format validation and conversion
• Implemented SARIF output generation with proper schema compliance and severity mapping
• Updated CLI help documentation and test coverage for the new format option

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scan-command/src/main/java/io/ballerina/scan/ReportFormat.java	New enum defining supported report formats with validation
scan-command/src/main/java/io/ballerina/scan/internal/ScanCmd.java	Updated command class to support format option and SARIF output generation
scan-command/src/main/java/io/ballerina/scan/utils/ScanUtils.java	Enhanced utility methods to support SARIF format generation and output
scan-command/src/main/java/io/ballerina/scan/utils/Constants.java	Added SARIF-related constants for schema and tool metadata
scan-command/src/test/java/io/ballerina/scan/internal/ScanCmdTest.java	Comprehensive test coverage for format validation and output generation
scan-command-test-utils/src/main/java/io/ballerina/scan/test/TestOptions.java	Updated test utilities to support format testing
Documentation files	Updated help text and README with format option examples

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud