Quickstart

Install

go install github.com/xilasec/xila/cli/xila@latest
xila version

Alternatively, download the archive for your OS and architecture from GitHub Releases and verify it with the published checksums.txt.

Scan a build

xila scan ./Build

The report goes to stdout. A one-line coverage summary goes to stderr, so JSON and SARIF can be piped without contamination.

xila scan ./Build --format json | jq '.findings[] | {severity, rule, title}'
xila scan ./Build --format sarif --out xila.sarif

Scanning does not fail a build by default. Add an explicit gate after reviewing the first report:

xila scan ./Build --fail-on high

Exit codes are 0 for a completed scan below the gate, 1 for gated findings, and 2 for usage or operational failure.

Introduce Xila without blocking releases

Create a baseline from the reviewed build, commit it, then gate future changes:

xila scan ./Build --write-baseline xila-baseline.json
xila scan ./Build --baseline xila-baseline.json --fail-on high

A baseline stores fingerprints, not evidence or credentials. Suppressed findings remain visible as suppressed in structured reports and do not trip the gate.

Add local policy

xila scan ./Build --rules ./security/rules
xila rules test ./security/rules

Built-in rules remain active. Use --no-embedded-rules only when the local pack must be the complete policy. Repeat --rules, --modules and --ignore as needed.

CI

The composite action writes SARIF and a job summary:

- id: xila
  uses: xilasec/xila/integrations/github-action@v0.1.0
  with:
    path: ./Build
    fail-on: high
- if: always()
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ${{ steps.xila.outputs.sarif }}

Grant security-events: write when uploading SARIF. The action verifies the release checksum before execution. GitLab and pre-upload examples are under integrations/.