clippy-sarif 0.5.0

Convert clippy output to SARIF
clippy-sarif-0.5.0 is not a library.

Workflow Status


This crate provides a command line tool to convert cargo clippy diagnostic output into SARIF.

The latest documentation can be found here.

clippy is a popular linter / static analysis tool for rust. More information can be found on the official repository:

SARIF or the Static Analysis Results Interchange Format is an industry standard format for the output of static analysis tools. More information can be found on the official website:


clippy-sarif may be installed via cargo

cargo install clippy-sarif

via cargo-binstall

cargo binstall clippy-sarif

or downloaded directly from Github Releases

# make sure to adjust the target and version (you may also want to pin to a specific version)
curl -sSL -o clippy-sarif


For most cases, simply run cargo clippy with json output and pipe the results into clippy-sarif.


cargo clippy --message-format=json | clippy-sarif

If you are using Github Actions, SARIF is useful for integrating with Github Advanced Security (GHAS), which can show code alerts in the "Security" tab of your repository.

After uploading clippy-sarif output to Github, clippy diagnostics are available in GHAS.


    workflows: ["main"]
    branches: [main]
    types: [completed]

name: sarif

    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
      - uses: actions/checkout@v2
      - uses: actions-rs/toolchain@v1
          profile: minimal
          toolchain: stable
          components: clippy,rustfmt
          override: true
      - uses: Swatinem/rust-cache@v1
      - run: cargo install clippy-sarif sarif-fmt
      - run: cargo clippy --all-targets --all-features --message-format=json |
          clippy-sarif | tee results.sarif | sarif-fmt
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v1
          sarif_file: results.sarif

In some cases, the path to the file contained in the SARIF report may be different than what is expected. This can happen for example if running clippy-sarif from a different folder than the crate folder. In this case consider using a tool like jq to amend to path:


cat results.sarif \
    | jq --arg pwd "some_folder/my_crate" '.runs[].results[].locations[].physicalLocation.artifactLocation.uri |= $pwd + "/" + .' \
    > results.sarif.tmp

Note that this maybe be fixed in a future release.

License: MIT