sarifix alerts export

sarifix alerts export¶

Write open code scanning alerts as SARIF for imported scanners

Synopsis¶

Read the repository's open code scanning alerts and write the ones that belong to imported scanners as one SARIF file, for plan and fix to read alongside sarifix's own scan. An imported scanner is one in sarifix.yaml with no command, such as CodeQL: sarifix never runs it, and its alerts already in code scanning become batches and issues like any other finding.

Each imported scanner gets a run even when it has no open alerts, so issues mode knows it was read and closes its fixed issues. Alerts from tools that no imported scanner matches are left out: sarifix's own scan already covers the scanners it runs. With no imported scanners, it writes nothing and calls no API.

Needs GITHUB_TOKEN (or GH_TOKEN) with security-events read, and GITHUB_REPOSITORY or --github-repo.

sarifix alerts export [flags]

Examples¶

  sarifix alerts export --github-repo acme/infra
  sarifix alerts export --out /tmp/alerts.sarif
  sarifix fix --mode issues --sarif 'sarif/*.sarif' --dry-run

Options¶

      --github-repo string   owner/name (default $GITHUB_REPOSITORY)
  -h, --help                 help for export
      --out string           SARIF file to write, relative to --repo (default "sarif/code-scanning.sarif")
      --ref string           the Git ref whose alerts to read, such as refs/heads/main (default: the default branch)

Options inherited from parent commands¶

      --config string       path to sarifix.yaml (default "sarifix.yaml")
      --json                machine-readable JSON output
      --log-level string    log level: debug, info, warn, error (default "info")
      --org-config string   org default config layered under --config
      --repo string         repository root (default ".")
      --settings string     settings file (default: search XDG config and home)

sarifix alerts export