Skip to content
PROCTOR Form 0.5.0
Menu

GitHub code scanning#

The sarif format feeds GitHub code scanning on the GitHub mirror. This page adds the workflow that uploads the log with the official action, pinned to a full commit SHA. Run the check with --format=sarif, and let the scanner show the findings on the files. PROCTOR now files the mark sheet in the format the head office already reads; no more translating the exam results by hand.

The workflow#

Add this workflow to the mirror. It sets up PHP, installs PROCTOR, runs the check against the app's CREED policy file, and uploads the resulting log:

name: proctor
on: [push, pull_request]
permissions:
  security-events: write
jobs:
  proctor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
      - run: composer require waynestate/proctor --dev
      # policy.json is the CREED policy file
      - run: vendor/bin/proctor check --format=sarif --policy=policy.json > proctor.sarif
      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          sarif_file: proctor.sarif

The --policy=policy.json argument names the app's CREED policy file; see Policy for how PROCTOR finds one when you do not name it.

What the log contains#

The uploaded proctor.sarif is a SARIF 2.1.0 log: one run, one rule per check, one result per non-pass finding.

  • The driver block names the tool proctor, its version, and the repository's information URI.
  • The rules list holds one entry per distinct rule id in the report, in first-seen order, each with a short description carrying the id.
  • Each result holds ruleId, level, message.text and one location. The level maps fail to error, warning to warning, and any other non-pass status to note.
  • The location uses the finding's path (backslashes normalized to forward slashes) and its line as region.startLine; a finding without a path points at the app's composer.json.
  • Each result also carries partialFingerprints with the finding's fingerprint under proctorFingerprint/v1, the stable identity of the finding.

See Formats for the shape of every format.