# SARIF Reporter

> Generate SARIF reports for GitHub Code Scanning integration.

## Installation

The SARIF reporter is included in jscpd v5 by default — no separate installation needed.

## Usage

```bash
jscpd --reporters sarif ./src
```

Output file: `./report/jscpd-sarif.json`

## GitHub Code Scanning Integration

Upload the SARIF output to GitHub to surface duplication findings inline in pull requests:

```yaml [.github/workflows/jscpd.yml]
name: Code duplication check
on: [push, pull_request]

jobs:
  jscpd:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run jscpd
        run: jscpd --reporters sarif --output ./reports .

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ./reports/jscpd-sarif.json
```

Results appear in the **Security → Code Scanning** tab of your repository and as inline annotations on pull request diffs.

## Configuration

```json [.jscpd.json]
{
  "reporters": ["sarif"],
  "output": "./reports/jscpd"
}
```

## How It Works

Each detected clone is reported as a `warning`-level SARIF result with precise file locations (line and column). If the overall duplication percentage exceeds the configured `--threshold`, an additional `error`-level result is emitted under the `duplications-threshold` rule.