Sarix Security Verification
Version updated for https://github.com/AvixoSec/sarix to version v0.4.0.
- This action is used across all versions by ? repositories.
Action Type
This is a Composite action.
Go to the GitHub Marketplace to find the latest changes.
Action Summary
Sarix is a security-focused CLI tool designed to enhance code scanning workflows by verifying and contextualizing alerts generated by tools like Semgrep and CodeQL. Its primary functionality includes importing SARIF reports, analyzing source code to validate alerts, reducing noise, and providing evidence-backed verdicts on potential vulnerabilities. By automating the verification process and offering structured insights into security issues, Sarix streamlines code review, reduces false positives, and improves the accuracy and clarity of CI reports.
What’s Changed
Sarix 0.4.0 (formerly CodeSight)
This release completes the rebranding of the project from CodeSight to Sarix to avoid naming collisions and establish a unique identity.
Core changes:
- Renamed the CLI entrypoint to
sarix(pip install sarix). - Replaced all
CODESIGHT_environment variables withSARIX_. - Migrated documentation and homepage to
sarix.avixosec.xyz. - Internal logic, verification models, and CI performance remain completely unchanged.
Migration:
If you have codesight in your CI pipelines, simply replace the package name and command with sarix. No architectural changes are required.