antra scan
Run static AST taint analysis across React Flight boundaries.
Runs the analysis and reports the findings it can prove from your source.
Usage
antra scan [path]
path is the Next.js app root and defaults to ..
antra scan
antra scan ./apps/dashboard
antra scan --format sarif --output report.sarif
Flags
Choosing a format
pretty is for a terminal. json is for a script that wants the finding
objects. sarif is what a code host understands, which is the format to reach
for in CI, because the host can then annotate the diff.
Scoping a scan
--diff and --staged exist so you can run the analysis over the part of the
project you are actually touching. --diff compares against --base, falling
back through origin/main, main, origin/master, and master until it finds
a ref that resolves.
antra scan --diff --base origin/main
antra scan --staged
Exiting non-zero in CI
A scan that finds something still exits 0 by default, so it never breaks a
build you didn't ask it to break. Add --fail-on-violation when you want the
step to fail:
antra scan --format sarif --output antra.sarif --fail-on-violation
--strict is broader than --fail-on-violation: it also treats warnings as
errors and requires a valid schema snapshot, so it can fail a build for
reasons that are not leaks.
Where results go
A full scan is recorded in .antra/antra-findings.sqlite unless you pass
--no-store. That database is what antra query reads
and what antra studio displays.
A partial scan is not recorded. When you pass --diff or --staged, the
whole project is still parsed, so cross-file taint still resolves, but only
the changed files are reported against. That partial result is deliberately
kept out of the database: Studio will not show it, and antra query will not
have it. Run a full scan when you want the run on the record.