Sarif
13 items tagged with "sarif"
Tutorials9
How to Add SAST Scanning to a CI Pipeline
Run static application security testing on every pull request, fail the build on high-severity findings, and report results as SARIF.
Choose an Output Format: Table, JSON, or SARIF
Switch the Vibgrate scan output between the default table, JSON for tooling, and SARIF for code scanning using the --format flag.
Upload Vibgrate SARIF to GitHub Code Scanning
Produce SARIF output with vg scan --format sarif and upload it to GitHub code scanning so drift findings appear in the Security tab and on PRs.
Run Vibgrate in a GitLab CI Pipeline
Add a drift-scanning job to .gitlab-ci.yml using the Vibgrate CLI, with artifacts and a SARIF report for merge requests.
Run Vibgrate on CircleCI
Add a Vibgrate drift-scanning job to a CircleCI config using a Node executor, store the SARIF report, and gate on a drift budget.
Surface Known-Vulnerable Dependencies with Vibgrate CLI
Use the Security Posture Scanner to surface audit counts and structural security hygiene, exporting results to SARIF for code scanning.
Scan a .NET Solution for Upgrade Drift
Point Vibgrate CLI at a .NET solution to measure upgrade drift across projects and produce a SARIF report for Azure DevOps.
Scan a Java/Maven Project for Upgrade Drift
Run Vibgrate CLI against a Java/Maven project to measure upgrade drift and export SARIF and Markdown reports.
Produce a SARIF Report for Security Tooling
Generate a SARIF report with vg scan --format sarif so drift findings flow into GitHub code scanning and other SARIF-aware security tools.
FAQs4
What output formats does the scan support?
Four formats: Text (default, colored human-readable), JSON (full artifact for automation), SARIF (for GitHub Code Scanning, Azure DevOps), and Markdow...
How do I upload SARIF results to GitHub Code Scanning?
Run scan with SARIF output: npx @vibgrate/cli scan --format sarif --out vibgrate.sarif --fail-on error. Then use github/codeql-action/upload-sarif@v3 ...
How do I gate pull requests on known vulnerabilities with GitHub Actions?
Use the maintained vibgrate/cli Action: `uses: vibgrate/cli@v1` with `vulns: true`, `fail-on: error`, and `upload-sarif: true`. It scans installed dep...
How do I set up Vibgrate in Azure DevOps?
Add NodeTool@0 task with versionSpec: '22.x', then run npx @vibgrate/cli scan --fail-on error. For SARIF artifacts: add --format sarif --out vibgrate....