GCC Integration Guide

Integrate GCC static analysis with Vulnetix. Use GCC 13+ SARIF output to capture compiler warnings and -fanalyzer findings in a format Vulnetix can ingest.

Install & scan

$ # Ubuntu/Debian (GCC 13+)
sudo apt-get install gcc-13 g++-13

# macOS via Homebrew
brew install gcc

# Verify version (need 13+ for SARIF)
gcc --version
$ # SARIF output to a file (named <source>.sarif automatically)
gcc-13 -fanalyzer -fdiagnostics-format=sarif-file -Wall -Wextra myfile.c

# Or emit SARIF to stderr and redirect
gcc-13 -fanalyzer -fdiagnostics-format=sarif-stderr -Wall myfile.c 2> gcc.sarif

Run GCC in CI

Scan on every push and upload the results to Vulnetix:

- name: Install GCC 13
  run: sudo apt-get install -y gcc-13

- name: Run GCC Static Analyzer
  run: |
    find src/ -name "*.c" | xargs -I{} gcc-13       -fanalyzer -fdiagnostics-format=sarif-file       -Wall -c {} -I include/ 2>/dev/null || true

- name: Upload to Vulnetix
  run: |
    for f in src/*.sarif; do vulnetix upload --file "$f"; done

Centralise GCC results in Vulnetix

Upload GCC SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

GCC documentation ↗  ·  Source repository ↗

Wire GCC into your CI/CD pipeline →