sarifix check

sarifix check¶

Report findings your uncommitted changes introduced

Synopsis¶

Scan the working tree with the scanners in sarifix.yaml, compare against a scan of --base (default HEAD), and report only the findings the changes introduced. Pre-existing findings are never reported.

The base scan is cached per commit and config under the git directory (.git/sarifix/scans/), so after the first run only the working tree is scanned. --refresh rebuilds it, for example after upgrading a scanner.

New findings at or above rules.min_level are reported unless rules.deny or paths.deny excludes them. rules.allow is ignored: it says what sarifix may fix on its own, while anything a change introduced is worth knowing about. Pass --allowed-only to apply it too.

Exits 0 when nothing new was found and 3 when something was.

With --hook, check runs as a Claude Code Stop hook. It reads the hook payload from stdin, always exits 0, and answers in JSON on stdout: - clean changes: no output - new findings: additionalContext, so Claude fixes them before finishing - findings that remain after that follow-up (stop_hook_active), or a check that couldn't run: systemMessage, a warning shown to you that doesn't block again A repo without sarifix.yaml, or outside git, is skipped.

sarifix check [flags]

Examples¶

  sarifix check
  sarifix check --base origin/main --json
  sarifix check --hook   # in a Claude Code Stop hook

Options¶

      --allowed-only   only report rules in rules.allow
      --base string    commit to compare the working tree against (default "HEAD")
  -h, --help           help for check
      --hook           run as a Claude Code Stop hook (reads the hook payload from stdin)
      --refresh        rebuild the cached scan of --base

Options inherited from parent commands¶

      --config string       path to sarifix.yaml (default "sarifix.yaml")
      --json                machine-readable JSON output
      --log-level string    log level: debug, info, warn, error (default "info")
      --org-config string   org default config layered under --config
      --repo string         repository root (default ".")
      --settings string     settings file (default: search XDG config and home)