Vetrix Security Tooling
Vetrix is a meta-orchestrator for open-source security + quality tooling. It does not replace the underlying scanners — it picks the right ones per language, normalises their output to SARIF 2.1.0, and gates merges / deployments on the findings.
When to read which page
| Starting point | Page |
|---|---|
| "Set this up on my repo today" | quickstart.md |
| "What does the Configure wizard do?" | configure.md |
| "Which scanner fires on which language?" | auto-detect.md |
"What fields does .vetrix/tooling.yml accept?" |
schema.md |
| "How do I enable / tune one scanner?" | scanners/README.md |
| "How do I write a merge-gate policy?" | policies.md |
| "How do I export findings for the security team?" | exports.md |
| "How does the pre-commit scaffolder work?" | pre-commit.md |
Product surfaces covered
- Pre-commit — client-side, opt-in, scaffolded from
.vetrix/tooling.yml. Seepre-commit.md. - Pre-receive — server-side, blocking, gitleaks in-process. Rejects the push on a finding; no CI round trip needed.
- CI (Automations) — full polyglot suite dispatched by the
vetrix/security-scan@<SHA>composite action. SARIF flows through the/security/ingestendpoint into the findings store. - Dashboard —
/[owner]/[repo]/security/findingsis the primary operator surface. Dedup happens by fingerprint; noise kills signal. - PR annotator — inline comments for new-only findings. Cumulative backlog stays on the dashboard; the annotator only comments on deltas.
- SBOM — CycloneDX emitted per build, content-addressed in the blob store, retrievable by commit SHA.
Scope line
This documentation covers the Vetrix-side contract. Individual scanner
configuration (gosec rule sets, Semgrep rule packs, Trivy ignore files)
is authored in the scanner's own format and committed alongside
.vetrix/tooling.yml. We link out to each scanner's upstream docs on the
per-scanner pages rather than duplicating them here.