CI and code scanning

Add it to a workflow

Run the audit, write a SARIF log, then hand the log to code scanning. The upload step runs even when the audit fails, so a drift still lands as an annotation on the pull request.

name: lockstep
on: [push, pull_request]

jobs:
  lockstep:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.x

      - name: Audit toolchain versions
        run: bunx github:srivtx/lockstep#main --fail-on warning --sarif lockstep.sarif

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: lockstep.sarif

What a SARIF result contains

Each finding becomes one SARIF result:

• ruleId is the rule code, such as LOCK-001.
• level is mapped from severity: error → error, warning → warning, info → note.
• The physical location points at the file named by the finding, so the annotation lands on the pull request.
• properties.tags carries the original severity.

Failing the build

Without --sarif, the exit code is the gate. lockstep exits 1 on any error-severity finding by default. Add --fail-on warning to fail on warnings too, or --fail-on none to report without failing. The flag changes only the exit code; the report is the same either way.

A clean run

A project whose sources agree passes with no findings. Every declared version is still printed, so the run doubles as a summary of what the toolchain pins.

$ bunx github:srivtx/lockstep#main --fail-on warning --sarif lockstep.sariffixtures/clean  errors:0  warnings:0  info:0node  .github/workflows/ci.yml:setup-node  20node  .node-version  20.11.0node  .nvmrc  20.11.0node  engines.node  20packageManager  .github/workflows/ci.yml:pnpm/action-setup  9.12.0packageManager  packageManager  pnpm@9.12.0exit 0

A drifted project instead prints the findings and exits 1. See Rules for what each code means.