CMake SARIF Integration Guide

Integrate CMake build analysis with Vulnetix. Convert CMake build output warnings to SARIF format and upload to Vulnetix for C/C++ build-time security analysis.

Install & scan

$ # Use GCC 13+ (has native SARIF output)
sudo apt-get install gcc-13

# Or use Clang/LLVM static analysis
sudo apt-get install clang clang-tidy
$ # Use GCC 13+ SARIF output directly
cmake -B build -DCMAKE_C_FLAGS="-Wall -Wextra -fdiagnostics-format=sarif-file"
cmake --build build 2>&1 || true
# GCC writes .sarif files alongside source files

# Or use clang-tidy with SARIF output
cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
clang-tidy -p build src/*.cpp --export-fixes=tidy-fixes.yaml

Run CMake SARIF in CI

Scan on every push and upload the report as a workflow artifact:

- name: Build with GCC SARIF output
  run: |
    cmake -B build -DCMAKE_C_FLAGS="-Wall -Wextra -fdiagnostics-format=sarif-file"
    cmake --build build 2>&1 || true
    find . -name "*.sarif" -exec cat {} + > cmake-warnings.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cmake-sarif
    path: cmake-warnings.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CMake SARIF's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CMake SARIF. Keep running it. Vulnetix sits on top of CMake SARIF (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What CMake SARIF does well

• Native SARIF export added in CMake 4.0 via --sarif-output or the CMAKE_EXPORT_SARIF cache variable, with no extra tooling to install
• Emits the content, severity level and site-of-origin of CMake's own configure/generate diagnostics in the standard OASIS JSON SARIF format
• SARIF is designed to aggregate results from multiple tools and runs, so CMake's output slots into the same pipeline as compiler and analyzer SARIF
• Works with any CMake-driven project and fits existing CI with no separate scanner to deploy

Where Vulnetix adds to it: Vulnetix ingests the SARIF CMake emits and folds those build-system diagnostics into the unified prioritised queue alongside real SAST/SCA signal, adding dedup, exploit-intel, reachability, VEX and SSVC. CMake only produces the SARIF; Vulnetix does not generate or replace it.

No migration, no rip-and-replace. CMake SARIF keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CMake SARIF results in Vulnetix

Upload CMake SARIF SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CMake SARIF documentation ↗

Wire CMake SARIF into your CI/CD pipeline →