# Share a Clippy Report — Rust Lints as SARIF, Then a Link

Canonical: https://commareports.com/share-clippy-report
Published: 2026-09-15

> cargo clippy prints to a terminal and nowhere else. Pipe its JSON through clippy-sarif, render the SARIF, and publish to Comma so the lint backlog becomes triage-able.

# Share a Clippy report

Clippy on a codebase that has never run it produces a number nobody wants to
look at. The findings are good — that is the problem. Several hundred real
suggestions arrive as terminal output, get skimmed once, and then the crate
gets `#![allow(clippy::all)]` at the top and everyone moves on.

A backlog is triaged collectively or not at all, and collective triage needs a
URL.

## JSON → SARIF → HTML

```bash
cargo install clippy-sarif sarif-fmt
pip install sarif-tools

cargo clippy --all-targets --all-features --message-format=json \
  | clippy-sarif > clippy.sarif
sarif html clippy.sarif --output clippy.html
```

`clippy-sarif` is the same converter the GitHub code-scanning action uses, so
if you already upload SARIF you have the file and only need the render step.

## Publish it

Drag `clippy.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html clippy.html \
        --arg title "Clippy — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

Keep `cargo clippy -- -D warnings` as its own step if you want the gate. The
report step is documentation, not enforcement.

## Turning a backlog into work

PATCH one report id per crate and the revision history *is* the cleanup
record — a number that goes down, with the runs that moved it.

- **Anchored threads** on a rule cluster: "we're allowing
  `clippy::too_many_arguments` in the FFI module, here's why" — recorded next
  to the findings rather than only in a `#[allow]` attribute nobody reads.
  See [commenting on HTML](/comment-on-html).
- **A [routine](/features/routines/scheduled-html-reports)** re-running weekly,
  so progress is visible without anyone maintaining a spreadsheet.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
  A first run on a large workspace is the one that gets close — scope it with
  `-p <crate>` for the shareable view.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a lint report →](https://commareports.com/)**

### Related

- [Share a SARIF report](/share-sarif-report) · [Share a Ruff report](/share-ruff-report)
- [Share a golangci-lint report](/share-golangci-lint-report) · [Share an ESLint report](/share-eslint-report)
- [Share a cargo-nextest report](/share-cargo-nextest-report) · [Publish from CI](/docs/ci)