SARIF and code scanning

--format sarif emits SARIF 2.1.0, ready for github/codeql-action/upload-sarif.

From the CLI

garboard gate . --format sarif > garboard.sarif

SARIF goes to stdout, so you redirect it yourself.

From the Action — the part that catches people

A Docker action’s stdout cannot be redirected by the caller. A workflow step is not a shell pipeline, so this does not work:

# BROKEN — nothing writes garboard.sarif
- uses: <the garboard action>
  with:
    format: sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: garboard.sarif      # this file does not exist

Use output-file, which redirects inside the container where redirection is actually possible:

- uses: <the garboard action>
  with:
    format: sarif
    output-file: garboard.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: garboard.sarif

output-file does not change the exit status: a blocking finding still fails the step, and the report is still written. Writing the report and failing the build are independent.

This page exists because our own README documented the broken version for months. It is fixed, and the fix is an input rather than a note telling you to do something you cannot.

Control tags

CIS AWS Foundations Benchmark v3.0.0 and SOC 2 mappings surface in properties.tags in SARIF, and as a frameworks array under --format json.

A rule with no defensible mapping ships untagged rather than stretched. That is why the tags are worth something: the absence of a tag is information too.

These tags are evidence toward a control an auditor already cares about. They are not a certification, and Winch Labs holds no SOC 2 or ISO 27001 as a company. See data flow.