Stylelint Integration Guide

Integrate Stylelint with Vulnetix. Lint CSS, SCSS, and Less files for errors and security anti-patterns, then upload JSON or SARIF results.

Install & scan

$ # Run without installing
npx stylelint --version

# Or install locally
npm install --save-dev stylelint stylelint-config-standard
$ # JSON output (built-in)
npx stylelint "**/*.{css,scss}" --formatter json > stylelint.json

# SARIF output (requires stylelint-sarif-formatter)
npm install --save-dev stylelint-sarif-formatter
npx stylelint "**/*.{css,scss}"   --custom-formatter=node_modules/stylelint-sarif-formatter   -o stylelint.sarif

Run Stylelint in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Stylelint
  run: |
    npm install stylelint stylelint-config-standard stylelint-sarif-formatter
    npx stylelint "**/*.{css,scss}"       --custom-formatter=node_modules/stylelint-sarif-formatter       -o stylelint.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: stylelint
    path: stylelint.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Stylelint's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Stylelint. Keep running it. Vulnetix sits on top of Stylelint (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What Stylelint does well

• 100+ built-in rules for modern CSS, plus SCSS/Sass/Less/SugarSS via plugins, and can extract embedded styles from HTML, Markdown and CSS-in-JS template literals
• Built-in auto-fix that safely rewrites many violations, backed by ~15k unit tests for robustness
• De-facto standard CSS linter adopted across major frontend toolchains, with a large shareable-config and plugin ecosystem
• Flexible formatter model (built-in JSON output) that can be piped or extended with community SARIF formatters for CI/code-scanning

Where Vulnetix adds to it: Vulnetix ingests and orchestrates Stylelint's JSON/SARIF output into its unified, deduplicated queue rather than running CSS linting itself; Vulnetix's built-in SAST (rules + Semgrep) targets application-code security and does not replace Stylelint's CSS convention enforcement. Together, Stylelint owns stylesheet quality while Vulnetix adds cross-scanner dedup, exploit-intel prioritisation and VEX.

No migration, no rip-and-replace. Stylelint keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Stylelint results in Vulnetix

Upload Stylelint JSON, SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Stylelint documentation ↗  ·  Source repository ↗

Wire Stylelint into your CI/CD pipeline →