Skip to content
Worker Safety

Command line

scan

Section titled “scan”
worker-safety scan [paths...] [options]


  paths                   Files or directories to scan. Defaults to the
                          configured paths, then the framework defaults.


  -c, --config=FILE       Path to a configuration file.
  -f, --format=FORMAT     console (default), json, sarif.
  -r, --runtime=RUNTIME   frankenphp, octane, roadrunner, swoole or all.
                          Repeatable, and accepts a comma separated list.
      --fail-on=SEVERITY  critical, high, medium, low, info or never.
      --project-dir=DIR   Project root. Defaults to the working directory.
      --baseline=FILE     Path to the baseline file.
      --no-baseline       Ignore an existing baseline file.
      --generate-baseline Write current findings to the baseline and exit 0.
      --no-progress       Do not render a progress bar.
      --allow-parse-errors
                          Report unanalyzable files as warnings instead of
                          failing the scan.
      --no-ansi           Disable colour.
  -q, --quiet             Suppress output; rely on the exit code.
  -v                      Also print stack traces for internal errors.

test

Section titled “test”

Available since 1.2.0. See the runtime replay guide for a complete example.

Terminal window
worker-safety test --scenario=worker-safety.replay.yaml
worker-safety test worker-safety.replay.yaml --format=json
Option Meaning
--scenario, -s Scenario file. Also accepted as a positional argument.
--base-url, -b Override the scenario’s base_url.
--format, -f console (default) or json.
--timeout, -t Per-request inactivity timeout in seconds (default 10).
--quiet, -q Suppress output; the exit code still reports the result.

Replays HTTP requests against an already-running single-worker instance to see whether a later request can observe an earlier one’s state. It never loads or executes the target application. See Runtime replay.

rules

Section titled “rules”

Lists the rule set, or one rule in detail. Supports --format=table|json.

init

Section titled “init”

Writes a commented worker-safety.yaml with defaults matching the detected framework. Refuses to overwrite an existing file unless --force is given, and never prompts — safe to run in CI.

baseline

Section titled “baseline”

Records every current finding so that only new ones fail the build. See Baseline.