rorix scan

Scan .NET and Node.js project dependencies for known vulnerabilities, license compliance issues, and supply-chain risks.

CI gate warning: the currently published Rorix.Cli 0.1.2 can return exit code 0 after a blocking vulnerability or policy finding, or when no supported manifest is found. Do not rely on this version as a required CI check. The gate behavior below describes the corrected 0.1.3 candidate; use it only after the corrected package is published and the failing-case release checks pass.

Usage

rorix scan [path] [options]

If no path is provided, Rorix scans the current directory.

Options

| Option | Default | Description | | --- | --- | --- | | --format | table | Output format: table, json, or sarif | | --exit-code | false | Exit with code 1 if vulnerabilities are found | | --policy | — | Path to a .rorix.yml policy file |

Examples

Scan the current directory

rorix scan

Scan a specific project

rorix scan ./src/MyApp/MyApp.csproj

For npm, point to a package-lock.json or its containing directory:

rorix scan ./package-lock.json

Output as JSON

rorix scan --format json

Fail in CI when vulnerabilities are found (after the corrected release)

rorix scan --exit-code

Enforce a policy file (after the corrected release)

rorix scan --policy .rorix.yml --exit-code

Generate SARIF output for GitHub Security tab

rorix scan --format sarif > results.sarif

Exit Codes

These are the intended exit codes for the corrected 0.1.3 candidate, not the currently published 0.1.2 package.

| Code | Meaning | | --- | --- | | 0 | Scan completed and no requested gate failed | | 1 | A vulnerability or policy gate failed, or a scan/authentication error occurred | | 2 | No supported dependency manifest was found |