oxlint-json-to-sarif

Convert oxlint JSON output to Static Analysis Results Interchange Format (SARIF) for Github Code Scanning.

Usage

File Input

npx oxlint-json-to-sarif --input oxlint-output.json --output results.sarif

stdin

oxlint --format json | npx oxlint-json-to-sarif --output results.sarif

stdout

npx oxlint-json-to-sarif --input oxlint-output.json > results.sarif

Aliases

npx oxlint-json-to-sarif -i oxlint-output.json -o results.sarif

CLI Options

• --input , -i : path to the oxlint JSON input file
• --output , -o : path to write SARIF output (defaults to stdout)
• --help: show help
• --version: show version

Node.js Usage

import { convertOxlintToSarif } from 'oxlint-json-to-sarif';
import { readFile, writeFile } from 'node:fs/promises';

const json = await readFile('oxlint-output.json', 'utf-8');
const sarif = convertOxlintToSarif(json);
await writeFile('results.sarif', sarif, 'utf-8');

Rationale

Problem

GitHub Actions can surface lint results as annotations in the Files changed tab of a pull request:

However, these annotations only appear in the Files changed tab. Contributors who are new to GitHub are often unfamiliar with this interface and may not notice the annotations until a project maintainer points them out, extending the review cycle of a pull request.

Solution

SARIF scan results, on the other hand, are shown directly on the Conversation tab — the default view when opening a pull request. This means contributors can see lint results immediately and fix them right away, without needing a reminder from maintainers.

Once the lint issues are fixed, the annotations are automatically collapsed:

Development

pnpm install
pnpm build
pnpm test

License

MIT