Ruff Integration Guide

Integrate Ruff with Vulnetix. Fast Python linter with built-in security rules (Bandit equivalent) and native SARIF output.

Install & scan

$ uv run --with ruff ruff version
$ uv run --with ruff ruff check --output-format sarif -o ruff.sarif .

Run Ruff in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Ruff
  run: |
    pip install ruff
    ruff check --output-format sarif -o ruff.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: ruff
    path: ruff.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Ruff's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Ruff. Keep running it. Vulnetix sits on top of Ruff (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What Ruff does well

• Extreme speed: Rust-based, 10-100x faster than legacy Python linters, so it runs on every save and in pre-commit without friction
• Tool consolidation: reimplements 900+ rules drawn from flake8, isort, pyupgrade, pydocstyle, autoflake and Black formatting in one binary
• Native flake8-bandit (S-prefix) reimplementation gives Bandit-equivalent Python security checks (hardcoded secrets, subprocess/shell injection, weak crypto, insecure tmp) at Ruff speed
• Autofix for a large share of lint rules and first-class editor/LSP integration

Where Vulnetix adds to it: Ruff is a Python-only lint/format tool whose security value is the optional Bandit `S` ruleset; it has no SCA, container, IaC, secrets-vault, SBOM, dedup, exploit-intel, VEX or SSVC. Vulnetix ingests Ruff/Bandit-class SAST output and layers cross-scanner dedup, EPSS/KEV/LEV prioritisation, reachability and versioned VEX on top across 40+ ecosystems and every language, rather than replacing Ruff's fast in-editor Python linting.

No migration, no rip-and-replace. Ruff keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Ruff results in Vulnetix

Upload Ruff SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Ruff documentation ↗  ·  Source repository ↗

Wire Ruff into your CI/CD pipeline →