SARIF Reporter

Installation

npm install @jscpd/sarif-reporter

Usage

jscpd --reporters sarif ./src

Output file: ./report/jscpd-sarif.json

GitHub Code Scanning Integration

Upload the SARIF output to GitHub to surface duplication findings inline in pull requests:

name: Code duplication check
on: [push, pull_request]

jobs:
  jscpd:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run jscpd
        run: npx jscpd --reporters sarif --output ./reports .

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ./reports/jscpd-sarif.json

Results appear in the Security → Code Scanning tab of your repository and as inline annotations on pull request diffs.

Configuration

{
  "reporters": ["sarif"],
  "output": "./reports/jscpd"
}

How It Works

Each detected clone is reported as a warning-level SARIF result with precise file locations (line and column). If the overall duplication percentage exceeds the configured --threshold, an additional error-level result is emitted under the duplications-threshold rule.