sarifix scan

sarifix scan

Run configured scanners and write SARIF

Synopsis

Run every scanner in sarifix.yaml (or the ones named with --scanner) over the whole repo and write one SARIF file per scanner to --out-dir, named .sarif. Each result gets a sarifix/v1 partial fingerprint so later diffs match findings without needing the files.

A scanner that exits non-zero but writes SARIF counts as a success, since most tools exit non-zero when they find something.

sarifix scan [flags]

Examples

  sarifix scan
  sarifix scan --scanner trivy --out-dir sarif/
  sarifix scan --dry-run

Options

      --dry-run           print the commands that would run, run nothing
  -h, --help              help for scan
      --out-dir string    directory for <scanner>.sarif files, relative to --repo (default "sarif")
      --scanner strings   only run these scanners (repeatable)

Options inherited from parent commands

      --config string       path to sarifix.yaml (default "sarifix.yaml")
      --json                machine-readable JSON output
      --log-level string    log level: debug, info, warn, error (default "info")
      --org-config string   org default config layered under --config
      --repo string         repository root (default ".")
      --settings string     settings file (default: search XDG config and home)

SEE ALSO

• sarifix - Turn any SARIF scanner into a verified auto-fixer