Rust Clippy Integration Guide

Integrate Rust Clippy with Vulnetix. Lint Rust code and convert output to SARIF using the clippy-sarif converter.

Install & scan

$ cargo install clippy-sarif
$ cargo clippy --message-format=json 2>&1 | clippy-sarif -o clippy.sarif

Run Rust Clippy in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install clippy-sarif
  run: cargo install clippy-sarif
- name: Run Clippy
  run: cargo clippy --message-format=json 2>&1 | clippy-sarif -o clippy.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: clippy
    path: clippy.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Rust Clippy's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Rust Clippy. Keep running it. Vulnetix sits on top of Rust Clippy (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Rust Clippy is strongest at its core category and also carries features in Compilers, Linters & Code Quality, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Rust Clippy does well

• Official Rust linter bundled with the toolchain (rustup component) - hundreds of lints available in every Rust project with zero install friction
• Organised, tunable lint categories (correctness deny-by-default, suspicious, complexity, perf, pedantic, restriction) so teams dial in signal
• Security-relevant restriction/correctness lints catch panics, unwrap/expect misuse, unsafe patterns and incorrect error handling
• Built-in autofix via `cargo clippy --fix` that mechanically applies many suggestions to the working tree

Where Vulnetix adds to it: Clippy is a Rust quality/correctness linter, not a security scanner; Vulnetix does not run Clippy's lints. Better together: pipe Clippy output through clippy-sarif and Vulnetix ingests that SARIF into its unified deduplicated queue alongside real SAST/SCA/secrets findings, then layers exploit-intel prioritisation, reachability, versioned VEX, Safe Harbour autofix and SSVC/EOL policy that Clippy does not provide.

No migration, no rip-and-replace. Rust Clippy keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Rust Clippy results in Vulnetix

Upload Rust Clippy SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Rust Clippy documentation ↗  ·  Source repository ↗

Wire Rust Clippy into your CI/CD pipeline →