sarifix plan

sarifix plan

Show the batches a fix run would attempt, and why findings are skipped

Synopsis

Read SARIF, apply sarifix.yaml's rules, and print the batches a fix run would attempt, in order, plus a count of skipped findings by reason. No agent is called and nothing is written.

Batches group findings by / (or campaign), split to respect limits.files_per_batch and limits.findings_per_batch, ordered by severity then size. Batches over limits.batches_per_run are listed as deferred.

sarifix plan [flags]

Examples

  sarifix plan --sarif 'sarif/*.sarif'
  sarifix plan --sarif 'sarif/*.sarif' --rule 'checkov/*' --details
  sarifix plan --sarif pr.sarif --baseline base.sarif --json

Options

      --baseline strings       SARIF of the base scan; findings also in it are skipped
      --baseline-root string   checkout the baseline was scanned in, for SARIF that 'sarifix scan' didn't write (default --repo)
      --campaign string        only findings in this campaign
      --details                list every finding under its batch, and every skipped finding that matches --rule and --campaign
  -h, --help                   help for plan
      --rule strings           only rule keys matching these globs, like trivy/DS-*
      --sarif strings          SARIF files or globs to read (required)

Options inherited from parent commands

      --config string       path to sarifix.yaml (default "sarifix.yaml")
      --json                machine-readable JSON output
      --log-level string    log level: debug, info, warn, error (default "info")
      --org-config string   org default config layered under --config
      --repo string         repository root (default ".")
      --settings string     settings file (default: search XDG config and home)

SEE ALSO

• sarifix - Turn any SARIF scanner into a verified auto-fixer