Detekt Integration Guide

Integrate Detekt with Vulnetix. Analyze Kotlin code for code smells, complexity, and potential issues with SARIF output.

Install & scan

$ // build.gradle.kts
plugins {
    id("io.gitlab.arturbosch.detekt") version "1.23.7"
}
$ // In build.gradle.kts - enable SARIF reports
detekt {
    reports {
        sarif.required.set(true)
    }
}
// Then run: ./gradlew detekt

Run Detekt in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Detekt
  run: ./gradlew detekt
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: detekt
    path: build/reports/detekt/detekt.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Detekt's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Detekt. Keep running it. Vulnetix sits on top of Detekt (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What Detekt does well

• The de facto static analysis standard for Kotlin, covering Android, JVM, JS, Native and Multiplatform projects
• Rich rule set for complexity, code smells, formatting and potential bugs, easily extended with custom rules
• First-class build integration (Gradle, Maven, Bazel) with configurable baselines and thresholds
• Native SARIF report format (plus HTML/Markdown/XML) for GitHub Code Scanning and CI ingestion

Where Vulnetix adds to it: Detekt is the right tool for keeping Kotlin code clean and catching security-relevant smells; Vulnetix ingests its SARIF and consolidates those findings with true security scanners in one deduplicated, prioritised queue, adding exploit-intel, reachability, VEX and autofix that a quality-focused linter does not provide. Better together: Vulnetix sits on top of Detekt to prioritise and remediate, it does not replace Detekt's Kotlin analysis.

No migration, no rip-and-replace. Detekt keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Detekt results in Vulnetix

Upload Detekt SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Detekt documentation ↗  ·  Source repository ↗

Wire Detekt into your CI/CD pipeline →