Scanner Quickstart

For GitHub repositories, the lowest-friction path is the published Cerbi Logging Governance Scanner Action. Add it after checkout; the Action sets up .NET 10, installs Cerbi Scanner 1.1.0 by default, runs on the GitHub Actions runner, and exposes JSON, SARIF, and Markdown report paths.

Open Cerbi Scanner in GitHub Marketplace

permissions:
  contents: read

steps:
  - uses: actions/checkout@v7

  - name: Cerbi logging governance scan
    uses: Zeroshi/cerbi-scanner-action@v1

If your team uses Azure DevOps, install the free Cerbi Scanner extension in Visual Studio Marketplace, then add CerbiScan@1 to an existing pipeline.

Install Cerbi Scanner from Visual Studio Marketplace

steps:
- task: UseDotNet@2
  displayName: Install .NET 10 SDK
  inputs:
    packageType: sdk
    version: 10.0.x

- task: CerbiScan@1
  displayName: Cerbi logging governance scan
  inputs:
    scanPath: $(Build.SourcesDirectory)
    failOn: none

Cerbi Scanner 1.1.0 targets net10.0. A machine running the local global tool must have the .NET 10 LTS runtime; the SDK is the simplest option for developer machines and generic CI agents.

dotnet --version

The command should report a 10.0.x SDK. .NET 8-only hosts must install .NET 10 before running the current local Scanner release.

dotnet tool install -g Cerbi.Scanner

After installation, verify the CLI:

cerbi-scanner --version
cerbi-scanner --help

To update an existing global-tool install:

dotnet tool update -g Cerbi.Scanner

The package is available on NuGet.

From the repository or source folder you want to inspect:

cerbi-scanner scan . --fail-on none

--fail-on none is the safest first run: Scanner reports findings but does not fail the command because of finding severity.

Generate JSON, SARIF, and a Markdown summary in one local CLI run:

mkdir -p scan-results
cerbi-scanner scan \
  --path . \
  --fail-on none \
  --format json --output scan-results/findings.json \
  --sarif scan-results/findings.sarif \
  --summary scan-results/build-summary.md

GitHub Action users get the same report set automatically. When you are ready to use Scanner as a build gate, set fail-on: high or another supported threshold in the Action, or use the equivalent CLI threshold. See the CI/CD guide.

Scanner uses one language-neutral finding contract across these implementations. For the current rule set, see Scanner rules.