CLI reference
xila scan <path>
path may be a build directory, container or individual file.
| Flag | Meaning |
|---|---|
| `-f, --format text | markdown |
-o, --out FILE |
Write the report to a file instead of stdout. |
--fail-on SEVERITY |
Exit 1 for an unsuppressed finding at or above the threshold. Empty means never fail. |
--min-severity SEVERITY |
Remove lower-severity findings from the report. |
--baseline FILE |
Mark fingerprints in a baseline as suppressed. |
--write-baseline FILE |
Write all current fingerprints to a baseline. |
--rules DIR |
Load an additional rule-pack directory; repeatable. |
--no-embedded-rules |
Disable the built-in packs. |
--modules DIR |
Discover external xila-module.yaml manifests; repeatable. |
--allow-network |
Permit modules that declare network access. Off by default. |
--ignore GLOB |
Drop matching component paths; repeatable and supports **. |
--workers N |
Analyzer concurrency; 0 uses one worker per CPU. |
--timeout DURATION |
Whole-run deadline; default 15m, 0 disables it. |
--verbose |
Print component and finding progress to stderr. |
--quiet |
Omit the coverage summary from stderr. |
--no-color |
Disable terminal colour; NO_COLOR is also honored. |
Severity order is info, low, medium, high, critical.
Rule commands
xila rules list [DIR...]lists compiled built-in and optional packs.xila rules show RULE_ID [DIR...]prints one rule.xila rules test [DIR...]validates packs and runs declared fixtures.
Module commands
xila modules list [DIR...] lists built-ins plus external modules discovered in
the supplied directories.
Version and completion
xila versionorxila --versionprints version, commit, Go version and schema.xila completion bash|zsh|fish|powershellemits shell completion.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Scan completed and no finding reached the gate. |
| 1 | At least one unsuppressed finding reached --fail-on. |
| 2 | Invalid arguments, unreadable input, report failure or no supporting extractor. |