Add SARIF parser

[tushar-deepsource]

• Adds independent sarif-parser packaage, with tests and a CLI.
• Adds a CLI in run_community_analyzer.py which passes the correct issue_map.json, and a test for artifacts.
• Adds tox config and CI with reporting test coverage to DeepSource.

[srijan-deepsource]

Is this made up, or are we missing this in the mapping?

[tushar-deepsource]

Yes, that is made up. sarif-parser tests don't deal with real world mappings. Tests regarding that will be in the top level tests folder.

[srijan-deepsource]

Also, set up test coverage reporting?

[tushar-deepsource]

Also, set up test coverage reporting?

Don't have the perms to set secrets on this repo.

There's a TODO comment here.

Can you give an actual kube linter artifact? I'll write a test against that.

did our Python Analyzer stop catching these?

I think it only catches it if it's #TODO: ...

[srijan-deepsource]

Don't have the perms to set secrets on this repo.

Added DEEPSOURCE_DSN as a secret. Go ahead and make changes in the workflow to report it.

I think it only catches it if it's #TODO: ...

Can you verify and create issue? It should catch blanket TODOs as well.

[tushar-deepsource]

It does get raised on # TODO as well. Not sure why it didn't happen in this case.

def foo():
    pass # TODO

$ python -m marvin_py -sl /tmp/code/**/*.py            
{"path": "/tmp/code/a.py", "line": 1, "column": 0, "message-id": "PYL-C0104", "message": "Disallowed name \"foo\"", "context": null}
{"path": "/tmp/code/a.py", "line": 2, "column": 10, "message-id": "PYL-W0511", "message": "TODO", "context": null}