Skip to content

CI

Output formats

Pretty terminal output, stable JSON, schema-valid SARIF for code scanning, and per-platform inline annotations - what each format is for and how to wire it up.

Pretty (default)

One block per finding: a severity badge, the message, the allow-reason when a finding is suppressed, and an evidence link so every claim is checkable. Data warnings (fields that couldn't be fetched) are listed separately from policy findings. Color respects NO_COLOR and non-TTY output.

JSON - --json

rn-doctor --json > report.json

A stable-ordered, timestamp-free report (version: 1): summary counts, findings (each with package, rule, severity, message, evidence URL, suppression state, and the manifest file it belongs to), and data warnings. Safe to snapshot in tests or feed to your own tooling - two runs over the same inputs produce byte-identical output.

SARIF - --sarif

rn-doctor --sarif > rn-doctor.sarif

SARIF 2.1.0, validated against the official schema in the project's test suite. Findings map to SARIF results with real package.json line regions; allowlisted findings carry a suppressions entry with the justification, so code scanning shows them as accepted rather than open.

Upload to GitHub code scanning:

- run: npx --yes --package react-native-doctor-ci rn-doctor --sarif > rn-doctor.sarif
  continue-on-error: true # keep the upload step reachable; gate separately
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: rn-doctor.sarif

Inline CI annotations

Inside a supported CI, inline feedback is emitted automatically alongside the pretty output - GitHub workflow commands, Azure ##vso logging commands, or a Bitbucket Code Insights upload, picked by platform detection. --annotations forces it on elsewhere, --no-annotations off, and --ci <platform> selects a platform explicitly. Each annotation resolves the dependency's real line in package.json with a string-escape-aware walker, so a same-named key under scripts or devDependencies can never be annotated by mistake.

Severity maps directly: policy errors annotate as errors, warnings as warnings, and notes or allowlisted findings as notices - an allowlisted package never produces a red annotation. (Azure has no notice level, so it shows only errors and warnings.)

--json and --sarif are mutually exclusive and write to stdout; annotations only accompany the pretty format, so machine output is never polluted with workflow commands.

GitLab Code Quality - --gitlab-codequality

rn-doctor --gitlab-codequality gl-code-quality-report.json

Writes a CodeClimate-subset JSON report for GitLab's merge-request Code Quality widget. It is file output, so it composes with any stdout format including --json. Fingerprints are stable across line moves and message edits. See CI platforms for the pipeline wiring.