Integrate lintr with Vulnetix. Lint R source files for style, syntax, and potential bugs, then upload the SARIF report for tracking.
Install & scan
$ # Install from CRAN inside R
install.packages("lintr")
$ Rscript -e "
library(lintr)
lints <- lint_dir('.')
sarif_output(lints, filename = 'lintr.sarif')
"
Run lintr in CI
Scan on every push and upload the report as a workflow artifact:
- name: Set up R
uses: r-lib/actions/setup-r@v2
- name: Install lintr
run: Rscript -e "install.packages('lintr')"
- name: Run lintr
run: |
Rscript -e "
library(lintr)
lints <- lint_dir('.')
sarif_output(lints, 'lintr.sarif')
"
- name: Upload report
uses: actions/upload-artifact@v6
with:
name: lintr
path: lintr.sarif
if-no-files-found: warnThen one publish job hands every artifact in the run to Vulnetix, recorded under lintr's own name and version. Written once per workflow, however many scanners you run:
publish:
name: Publish to Vulnetix
runs-on: ubuntu-latest
needs: [scan] # every scanner job, or its report is never published
if: always() # or one failing scanner suppresses all the others
permissions:
contents: read
actions: read # required to list the run's artifacts
env:
VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
steps:
- uses: actions/checkout@v5
- name: Install Vulnetix CLI
run: |
curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Publish scanner reports
env:
GITHUB_TOKEN: ${{ github.token }}
run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --jsonAfter the run, vulnetix gha status reports what was actually recorded.
How Vulnetix compares: better together
Vulnetix does not replace lintr. Keep running it. Vulnetix sits on top of lintr (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
lintr is strongest at its core category and also carries features in SAST, just as Vulnetix spans categories.
| Capability | Vulnetix | lintr |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ~ Static analysis of R detecting syntax/semantic issues and some risky patterns; primarily style/quality, not a security scanner |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What lintr does well
- The de-facto standard R linter, maintained by r-lib (Posit/RStudio), covering ~100 linters for tidyverse style, syntax errors and semantic smells
- First-class CI/editor integration: SARIF output (lintr::sarif_output) for GitHub code-scanning plus RStudio/VS Code plugins and a GitHub Action
- Widely used gate in CRAN-bound R packages and data-science pipelines, making it the trusted quality baseline for the R ecosystem
- Highly configurable and extensible: custom linters and per-project .lintr config let teams codify their own R standards
Where Vulnetix adds to it: lintr is a code-style/quality linter for R, not a security scanner. It has no SCA, secrets, container, exploit-intel or remediation. Vulnetix ingests its SARIF alongside real security scanners and layers prioritisation, dedup, VEX and autofix. Better together: lintr keeps R code clean, Vulnetix owns the security queue.
No migration, no rip-and-replace. lintr keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise lintr results in Vulnetix
Upload lintr SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.