Workflow

From scan to SARIF to publish.

Security Advisor normalizes scan output, builds a unified SARIF report, and optionally converts the findings into the Vulnerability Manager schema for structured upload.

End-to-end flow — static & infrastructure scans

Scan the target

Run SAST, SCA, IaC, and optional container scans.

Build the SARIF report

Aggregate findings into a single report for downstream tooling.

Normalize for upload

Convert the findings into vulnerability_schema.json-compatible data.

Publish to the manager

Upload into the selected organization, project, service, and version.

End-to-end flow — Gemini AI code review

Run Gemini code review

Invoke security_gemini_code_review_skill against the repository root. The Gemini CLI reviews branch diff changes in non-interactive mode (--yolo --output-format json).

Parse & normalize

Findings (severity, file_path, line_number, issue, suggestion) are mapped into vulnerability_schema.json shape with source_tool: "Gemini Code Review".

Publish to the manager (optional)

Use security_gemini_publish_to_vulnerability_manager_skill to authenticate, resolve the org/project/service/version hierarchy, and upload in one step.