SARIF Reporter

Installation

The SARIF reporter is included in jscpd v5 by default — no separate installation needed.

Usage

jscpd --reporters sarif ./src

Output file: ./report/jscpd-sarif.json

GitHub Code Scanning Integration

Upload the SARIF output to GitHub to surface duplication findings inline in pull requests:

name: Code duplication check
on: [push, pull_request]

jobs:
  jscpd:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run jscpd
        run: jscpd --reporters sarif --output ./reports .

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ./reports/jscpd-sarif.json

Results appear in the Security → Code Scanning tab of your repository and as inline annotations on pull request diffs.

Configuration

{
  "reporters": ["sarif"],
  "output": "./reports/jscpd"
}

Size-Based Severity (v5.0.15+)

By default every clone is reported at level warning. --sarif-error-tokens <N> (config: sarifErrorTokens) escalates clones with at least N tokens to error, so large duplications fail stricter code-scanning policies while small ones stay advisory:

jscpd --reporters sarif --sarif-error-tokens 150 ./src

When overall duplication exceeds --threshold, all SARIF results are emitted as error, matching the threshold check that fails the build.

Result Identity & Related Locations (v5.0.15+)

• Each result carries a partialFingerprints entry (jscpdCloneHash/v1) plus token_count and clone_hash properties, so GitHub code scanning tracks the same clone across runs even when line numbers shift. The hash is order-insensitive — the same clone pair produces the same fingerprint regardless of file discovery order.
• The duplicate's counterpart location has its own message (Duplicated at <path>:<line>), referenced from the primary message via an embedded link, so code scanning shows both sides of the clone.

How It Works

Each detected clone is reported as a warning-level SARIF result with precise file locations (line and column). If the overall duplication percentage exceeds the configured --threshold, an additional error-level result is emitted under the duplications-threshold rule.