Skip to content

CI

Output formats

Pretty terminal output, stable JSON, schema-valid SARIF for code scanning, and GitHub inline annotations — what each format is for and how to wire it up.

Pretty (default)

One block per finding: a severity badge, the message, the allow-reason when a finding is suppressed, and an evidence link so every claim is checkable. Data warnings (fields that couldn't be fetched) are listed separately from policy findings. Color respects NO_COLOR and non-TTY output.

JSON — --json

rn-doctor --json > report.json

A stable-ordered, timestamp-free report (version: 1): summary counts, findings (each with package, rule, severity, message, evidence URL, suppression state, and the manifest file it belongs to), and data warnings. Safe to snapshot in tests or feed to your own tooling — two runs over the same inputs produce byte-identical output.

SARIF — --sarif

rn-doctor --sarif > rn-doctor.sarif

SARIF 2.1.0, validated against the official schema in the project's test suite. Findings map to SARIF results with real package.json line regions; allowlisted findings carry a suppressions entry with the justification, so code scanning shows them as accepted rather than open.

Upload to GitHub code scanning:

- run: npx --yes --package react-native-doctor-ci rn-doctor --sarif > rn-doctor.sarif
  continue-on-error: true # keep the upload step reachable; gate separately
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: rn-doctor.sarif

GitHub annotations

Inside GitHub Actions (GITHUB_ACTIONS=true) annotations are emitted automatically alongside the pretty output — --annotations forces them on elsewhere, --no-annotations off. Each one resolves the dependency's real line in package.json with a string-escape-aware walker, so a same-named key under scripts or devDependencies can never be annotated by mistake.

Severity maps directly: policy errors annotate as errors, warnings as warnings, and notes or allowlisted findings as notices — an allowlisted package never produces a red annotation.

--json and --sarif are mutually exclusive and write to stdout; annotations only accompany the pretty format, so machine output is never polluted with workflow commands.