SARIF

Home / Output / SARIF

SARIF output

--sarif writes a SARIF 2.1.0 log for GitHub Code Scanning and other SARIF consumers. Requires v1.19.0 or later. It is a local flag on the root review, on diff, on guard and on leaks. guard --sarif and leaks --sarif require v1.21.0 or later.

commitbrief diff origin/main...HEAD --sarif -o commitbrief.sarif

Upload with github/codeql-action/upload-sarif (permissions security-events: write, plus actions: read on private repositories). Use a distinct category so the results do not replace another tool's.

Categories

Each command writes its own automationDetails.id; upload each with the matching category:

Command	automationDetails.id	Upload category
Root review and diff	commitbrief/	commitbrief
guard	commitbrief/guard/	commitbrief/guard
leaks	commitbrief/leaks/	commitbrief/leaks

Code Scanning treats a result missing from a category as fixed. With one shared category, a clean leaks run would close the alerts a review opened, and the reverse. Separate categories keep each command's alerts independent.

guard --sarif

Requires v1.21.0 or later. The log holds only the findings that cause a policy violation. It is built from the same set the verdict is computed from, so the log and the exit code cannot disagree. A passing run writes a valid log with results: []. When the model response could not be parsed into structured findings, in run-mode or in a --from-json input, no file is written and the command exits 1.

leaks --sarif

Requires v1.21.0 or later. Every result uses the rule id sec.hardcoded-secret. A result never carries the matched text, a snippet or an author. The pattern names are in properties["commitbrief/patterns"]; for a history hit the short commit hash is in properties["commitbrief/commit"]. The human report moves to stderr and --fail-on still sets the exit code. Not with --json or --patterns.

It writes a log only for a complete scan, because a partial upload would close alerts it never checked:

• Combining it with --no-worktree, --no-history, --file, --dir, --exclude-file, --exclude-dir, --author, --committer, --start-date, --end-date, --text or a git range is a usage error.
• If the history scan stops at the --max-commits window, no file is written and the command exits 1. Pass a larger window with --max-commits N.
• If the history is longer than the commit walk can cover, no file is written and the command exits 1. --max-commits cannot raise that limit.

What a result carries

SARIF field	Value
ruleId, ruleIndex	The finding's rule id and its index in tool.driver.rules[]
level	critical/high is error, medium is warning, low/info is note
partialFingerprints["commitbrief/v1"]	The finding's fingerprint
locations[]	The finding's file and line
properties["commitbrief/severity"]	The original severity

A finding with line 0 or less is anchored on line 1 and marked properties["commitbrief/file-level"] = true.

Failure modes and limits

• Exclusive with --json, --markdown, --suggest-commit, --cli and --show-prompt.
• Refused with a CLI-backed provider, before any call.
• Fails closed: a degraded or unparsed response is an error, no file is written, exit 1.
• An empty diff after filtering writes a valid log with results: [].
• --min-severity does not filter SARIF.
• guard --sarif lists violating findings only; the other commands list every finding.

See also: SARIF and Code Scanning