oxlint-json-to-sarif

Convert oxlint JSON output to Static Analysis Results Interchange Format (SARIF) for Github Code Scanning.

Usage

File Input

npx oxlint-json-to-sarif --input oxlint-output.json --output results.sarif

stdin

oxlint --format json | npx oxlint-json-to-sarif --output results.sarif

stdout

npx oxlint-json-to-sarif --input oxlint-output.json > results.sarif

Aliases

npx oxlint-json-to-sarif -i oxlint-output.json -o results.sarif

CLI Options

• --input <path>, -i <path>: path to the oxlint JSON input file
• --output <path>, -o <path>: path to write SARIF output (defaults to stdout)
• --help: show help
• --version: show version

GitHub Actions Usage

# Similar to https://github.com/actions/starter-workflows/blame/main/code-scanning/eslint.yml
name: Oxlint

on:
  push:
  pull_request:

jobs:
  oxlint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: lts/*
      - name: Run oxlint
        run: |
          npx oxlint --format json | npx oxlint-json-to-sarif --output results.sarif
        continue-on-error: true
      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif
          wait-for-processing: true

Node.js Usage

import { convertOxlintToSarif } from 'oxlint-json-to-sarif';
import { readFile, writeFile } from 'node:fs/promises';

const json = await readFile('oxlint-output.json', 'utf-8');
const sarif = convertOxlintToSarif(json);
await writeFile('results.sarif', sarif, 'utf-8');

Rationale

Click to expand

Problem

While oxlint's github output format can surface lint results as annotations in the Files changed tab of a pull request:

These annotations only appear in the Files changed tab. Contributors who are new to GitHub are often unfamiliar with this interface and may not notice the annotations until a project maintainer points them out, extending the review cycle of a pull request.

Solution

SARIF scan results, on the other hand, are shown directly on the Conversation tab, which is the default view when opening a pull request. This means contributors can see lint results immediately and fix them right away, without needing a reminder from maintainers.

Once the lint issues are fixed, the annotations are automatically collapsed:

Development

pnpm install
pnpm build
pnpm test

License

MIT