Tutorials¶
Walk-throughs on real open-source repositories, each built around one job sarifix does. Every command was run for these pages, and every block of output is what it printed. Long output is trimmed where you see ....
- Triage an infrastructure backlog on terragoat (Terraform). Point two scanners at a repository, read a plan, and tune rules and limits until the work queue makes sense.
- Check only what a pull request introduced on terragoat. Diff two scans, and use
--baselineto keep pre-existing findings out of the way. - Compare against an older release on cobra (Go). Scan two commits like for like with golangci-lint, and avoid the settings that silently skew the comparison.
- Bring your own scanner and run a migration on awesome-compose (Dockerfiles). Plug in Hadolint and a short Python script, and group a migration into a campaign.
- Roll out a policy across repositories on microservices-demo (Kubernetes). Layer a platform default config under each repository's own, and keep generated files out of the queue.
- Give Claude Code feedback on its changes, for any repository. Run
sarifix check --hookas a Claude Code Stop hook, so Claude fixes the findings its changes introduced before it finishes. - Report on every pull request in GitHub Actions, for any repository. Run the pull-request check in CI and publish a job summary.
- Turn findings into issues Claude works through, for any GitHub repository. Scan the default branch, upload to code scanning, keep one agent-ready issue per batch, and let Claude fix them one pull request at a time.
Before you start¶
Install sarifix (see Getting started) and the scanners each tutorial uses. These pages were written with:
| Tool | Version | Used in |
|---|---|---|
| Trivy | 0.76.1 | infrastructure, pull requests, org policy |
| Checkov | 3.3.30 | infrastructure, pull requests, org policy |
| golangci-lint | 2.15.0 | release history |
| Hadolint | 2.15.1 | custom scanner |
| Python | 3.13 | custom scanner |
| jq | any | reading reports |
Other versions work. Their rules and counts will differ from the output shown here.
What these tutorials cover
sarifix doesn't run a fixing agent itself yet: the local, pr and review modes arrive in later phases. Claude fixes findings today through the Stop hook and through issues mode. These tutorials cover everything that runs today, namely scanning, fingerprints and diffs, the policy, batching, and the report and issues modes. Those decide what a fix run will do once fixing lands.
Each tutorial writes scan output into the repository (sarif/, sarifix-report/). In a repository of your own, add both to .gitignore: SARIF files are regenerated on every run and never committed. See Where SARIF files live.