Add configurable option for reachabilty filtering with SARIF

Signed-off-by: lelia <lelia@socket.dev>

Author: lelia

socketsecurity/config.py

@@ -41,6 +41,7 @@ class CliConfig:
     enable_json: bool = False
     enable_sarif: bool = False
     sarif_file: Optional[str] = None
+    sarif_reachable_only: bool = False
     enable_gitlab_security: bool = False
     gitlab_security_file: Optional[str] = None
     disable_overview: bool = False
@@ -132,6 +133,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'enable_json': args.enable_json,
             'enable_sarif': args.enable_sarif,
             'sarif_file': args.sarif_file,
+            'sarif_reachable_only': args.sarif_reachable_only,
             'enable_gitlab_security': args.enable_gitlab_security,
             'gitlab_security_file': args.gitlab_security_file,
             'disable_overview': args.disable_overview,
@@ -210,6 +212,11 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--workspace-name requires --sub-path to be specified")
             exit(1)
 
+        # Validate that sarif_reachable_only requires reach
+        if args.sarif_reachable_only and not args.reach:
+            logging.error("--sarif-reachable-only requires --reach to be specified")
+            exit(1)
+
         # Validate that only_facts_file requires reach
         if args.only_facts_file and not args.reach:
             logging.error("--only-facts-file requires --reach to be specified")
@@ -484,6 +491,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         default=None,
         help="Output file path for SARIF report (implies --enable-sarif)"
     )
+    output_group.add_argument(
+        "--sarif-reachable-only",
+        dest="sarif_reachable_only",
+        action="store_true",
+        help="Filter SARIF output to only include reachable findings (requires --reach)"
+    )
     output_group.add_argument(
         "--enable-gitlab-security",
         dest="enable_gitlab_security",