sarifix.yaml reference¶
Every key sarifix reads from sarifix.yaml, generated from the config schema. Unknown keys are an error. See Configuration for a guided tour.
| Key | Type | Default | Description |
|---|---|---|---|
version |
int | none | Schema version. Must be 1. |
scanners |
list of object | none | SARIF-emitting tools sarifix can run and route findings to. |
rules |
object | none | Which rules may be fixed. |
paths |
object | none | Which files may be changed. |
campaigns |
list of object | none | Named migrations tracked across repos. |
limits |
object | none | Batch sizes, retries and time limits. |
verify |
object | none | How a fix is proven before it is published. |
agent |
object | none | The AI agent that writes fixes. |
publish |
object | none | How verified fixes are published. |
scanners[]¶
SARIF-emitting tools sarifix can run and route findings to.
| Key | Type | Default | Description |
|---|---|---|---|
scanners[].name |
string | required | Unique ID, used in rule keys and branch names. |
scanners[].match |
list of string | [name] |
SARIF tool.driver.name values routed to this scanner (case-insensitive). |
scanners[].command |
list of string | required | argv to run, no shell. Placeholders are expanded per element. |
scanners[].output |
string | {out} |
Where the SARIF lands, for tools that choose their own file name. |
scanners[].workdir |
string | {repo} |
Working directory for the command. |
scanners[].env |
map of string | none | Extra environment variables. |
scanners[].scope |
string | dir |
Rescan scope during verify: changed, dir or repo. |
scanners[].timeout |
duration | 5m |
Time limit per invocation. |
scanners[].offline |
bool | false |
Run verify rescans with the network disabled. |
rules¶
Which rules may be fixed.
| Key | Type | Default | Description |
|---|---|---|---|
rules.allow |
list of string | none | Rule-key globs that may be fixed. Empty allows nothing. |
rules.deny |
list of string | none | Rule-key globs that are never fixed; wins over allow. |
rules.min_level |
string | warning |
Lowest SARIF level to fix: error, warning, note or none. |
paths¶
Which files may be changed.
| Key | Type | Default | Description |
|---|---|---|---|
paths.deny |
list of string | [.github/workflows/**] |
Path globs (** allowed) that are never edited. .github/workflows/** is always added. |
campaigns[]¶
Named migrations tracked across repos.
| Key | Type | Default | Description |
|---|---|---|---|
campaigns[].id |
string | required | Campaign ID, used as the batch key. |
campaigns[].scanner |
string | required | Name of the scanner that finds the old pattern. |
campaigns[].rules |
list of string | none | Rule-key globs in this campaign. |
campaigns[].pr_title |
string | none | Title for the campaign's PRs. |
campaigns[].labels |
list of string | none | Extra labels for the campaign's PRs. |
limits¶
Batch sizes, retries and time limits.
| Key | Type | Default | Description |
|---|---|---|---|
limits.files_per_batch |
int | 10 |
Most files one batch may touch. |
limits.findings_per_batch |
int | 25 |
Most findings in one batch. |
limits.batches_per_run |
int | 5 |
Most batches one run attempts. |
limits.retries |
int | 2 |
Extra attempts after a failed verify. |
limits.max_diff_lines |
int | 400 |
Largest diff the diff guard accepts. |
limits.agent_timeout |
duration | 10m |
Time limit for one agent call. |
verify¶
How a fix is proven before it is published.
| Key | Type | Default | Description |
|---|---|---|---|
verify.commands |
list of list of string | none | argv lists that must each exit 0, such as [[make, test]]. |
verify.require_no_new_findings |
bool | true |
Fail when the rescan finds anything new. |
agent¶
The AI agent that writes fixes.
| Key | Type | Default | Description |
|---|---|---|---|
agent.provider |
string | claude-code |
Agent implementation. v1 supports claude-code. |
agent.model |
string | none | Model name; empty uses the provider default. |
agent.extra_instructions |
string | none | Repo file with conventions added to every prompt. |
publish¶
How verified fixes are published.
| Key | Type | Default | Description |
|---|---|---|---|
publish.pr |
object | none | Settings for --mode pr. |
publish.review |
object | none | Settings for --mode review. |
publish.issues |
object | none | Settings for --mode issues. |
publish.pr¶
Settings for --mode pr.
| Key | Type | Default | Description |
|---|---|---|---|
publish.pr.branch_prefix |
string | sarifix |
Prefix for fix branches: |
publish.pr.draft |
bool | false |
Open PRs as drafts. |
publish.pr.labels |
list of string | [sarifix] |
Labels added to every PR. |
publish.pr.reviewers_from |
string | codeowners |
Where reviewers come from: codeowners or none. |
publish.review¶
Settings for --mode review.
| Key | Type | Default | Description |
|---|---|---|---|
publish.review.max_suggestions |
int | 20 |
Most suggested changes in one review. |
publish.issues¶
Settings for --mode issues.
| Key | Type | Default | Description |
|---|---|---|---|
publish.issues.label |
string | sarifix |
Label on every batch issue; sarifix only manages issues that carry it. |
publish.issues.max_open |
int | 10 |
Most batch issues open at once, the most severe batches first. |
publish.issues.queue |
int | 0 |
How many issues to keep labeled queue_label for an agent; 0 queues none. |
publish.issues.queue_label |
string | agent-ready |
Label that hands an issue to an agent queue. |