CI & SARIF

The GitHub Action

Drop Stratify into any workflow as a quality gate:

- uses: actions/checkout@v4
- uses: stratify-dev/stratify@v0.4.0
  with:
    path: .
    fail-on: warning

The action downloads a prebuilt stratify binary instead of compiling from source, so the step starts in seconds. If the download fails, the action installs a Rust toolchain when one isn't already present and builds from source with cargo install, which takes considerably longer than the usual few seconds. A normally-fast step suddenly crawling usually means this fallback fired, not a hang. Pin a released tag, like @v0.4.0, for stable runs across your team. Point at @main instead if you want every workflow run to track the newest commit on the default branch.

Action inputs

Input	Default	Description
`path`	`.`	Directory to analyze.
`fail-on`	`warning`	Minimum severity that fails the step: `never`, `info`, `warning`, or `error`.
`format`	`human`	Output format: `human`, `json`, or `sarif`.

SARIF and code scanning

Stratify emits SARIF 2.1.0, the format GitHub and GitLab both render as inline annotations on pull requests.

stratify check . --format sarif > stratify.sarif

Upload the file to GitHub code scanning as a second step:

- uses: actions/checkout@v4
- uses: stratify-dev/stratify@v0.4.0
  with:
    fail-on: never
- run: stratify check . --format sarif > stratify.sarif
- uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: stratify.sarif

Set fail-on: never on the action step here. You still get every finding in code scanning for review, without the workflow failing on a threshold you haven't decided to enforce yet.