Composer Audit to SARIF Action

Convert Composer audit reports to SARIF files

Built with ♥ by Typist Tech

---

Tip

Hire Tang Rufus!

I am looking for my next role, freelance or full-time. If you find this tool useful, I can build you more dev tools like this. Let's talk if you are hiring PHP / Ruby / Go developers.

Contact me at https://typist.tech/contact/

---

Gallery

Code scanning alerts

Code scanning alert details

Inline advisory pull request comment

Inline abandonment pull request comment

Usage

See action.yml and the underlying script ComSARIF.

  - uses: typisttech/composer-audit-to-sarif-action@v0
    with:
      # Path to audit JSON file
      #
      # Default: audit.json
      audit: some/path/to/audit.json

      # Path to composer.lock
      #
      # Default: composer.lock
      lock: some/path/to/composer.lock

      # Path to repository root
      #
      # Default: ${{ github.workspace }}
      root: some/path

      # Version of [ComSARIF] to use. Leave blank for latest. For example: v1.0.2
      #
      # [ComSARIF]: https://github.com/typisttech/comsarif
      #
      # Default: ''
      version: v1.0.2

      # Whether to verify ComSARIF tarball attestation.
      #
      # Default: true
      verify-attestation: false

      # GitHub token for authentication
      #
      # Default: ${{ github.token }}
      github-token: ${{ secrets.GITHUB_PAT_TOKEN }}

Outputs

Key	Description	Example
sarif	Path to the SARIF file	/tmp/comsarif-123.sarif

Tip

Hire Tang Rufus!

There is no need to understand any of these quirks. Let me handle them for you. I am seeking my next job, freelance or full-time.

If you are hiring PHP / Ruby / Go developers, contact me at https://typist.tech/contact/

Examples

Audit based on the lock file instead of the installed packages

name: Audit

on:
  workflow_dispatch:
  schedule:
    - cron: '0 9 * * *' # Daily
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read # for actions/checkout to fetch code
  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
  actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

jobs:
  composer-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
            composer.json
            composer.lock
          sparse-checkout-cone-mode: false

      - uses: shivammathur/setup-php@v2
        with:
          php-version: latest
          coverage: none

      - run: composer audit --locked --format json > audit.json
        continue-on-error: true
        # env:
        #  COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }} # if applicable

      - uses: typisttech/composer-audit-to-sarif-action@v0
        id: comsarif
        with:
          audit: audit.json

      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.comsarif.outputs.sarif }}

Audit based on installed packages

Tip

composer install is essential to typisttech/wp-org-closed-plugin.

        - uses: shivammathur/setup-php@v2
          with:
+           php-version: '8.5'
-           php-version: latest
            coverage: none

+       - run: composer install
+         # env:
+         #  COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }} # if applicable
+
+       - run: composer audit --format json > audit.json
-       - run: composer audit --locked --format json > audit.json
          continue-on-error: true
          # env:
          #  COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }} # if applicable

People Also Use

• ComSARIF CLI to convert Composer audit reports to SARIF files
• PHP Matrix Action Generate PHP version matrix according to composer.json for GitHub Actions
• WP Sec Adv Composer repository for WordPress security advisories
• WP Org Closed Plugin Composer plugin to mark packages as abandoned if closed on WordPress.org

Credits

Composer Audit to SARIF Action is a Typist Tech project and maintained by Tang Rufus, freelance developer for hire.

Full list of contributors can be found on GitHub.

Copyright and License

This project is a free software distributed under the terms of the MIT license. For the full license, see LICENSE.

Contribute

Feedbacks / bug reports / pull requests are welcome.