Does cargo clippy produce an HTML report?

No. It prints rustc-style diagnostics, or JSON with `--message-format=json`. The clean route to a page is `clippy-sarif` to convert the JSON to SARIF, then a SARIF-to-HTML renderer.

What is clippy-sarif?

A small Rust binary from the `sarif-fmt` family that reads `cargo clippy --message-format=json` on stdin and writes SARIF on stdout. It is what most GitHub code-scanning setups already use.

Why SARIF rather than plain JSON?

SARIF keeps the rule id, severity and the exact source region for each finding, and converters already exist for it. Clippy's raw JSON is rustc's diagnostic format, which nothing else renders.

Should clippy fail the build?

Keep `cargo clippy -- -D warnings` as a separate, unmuted gate step. The reporting step should never be the thing that fails the build.

Is this worth it for a small crate?

Less so. It pays off on a legacy crate with hundreds of findings, where the backlog only gets cleared if people can see it and claim slices of it.

Share a Clippy report

Clippy on a codebase that has never run it produces a number nobody wants to look at. The findings are good — that is the problem. Several hundred real suggestions arrive as terminal output, get skimmed once, and then the crate gets #![allow(clippy::all)] at the top and everyone moves on.

A backlog is triaged collectively or not at all, and collective triage needs a URL.

JSON → SARIF → HTML

cargo install clippy-sarif sarif-fmt
pip install sarif-tools

cargo clippy --all-targets --all-features --message-format=json \
  | clippy-sarif > clippy.sarif
sarif html clippy.sarif --output clippy.html

clippy-sarif is the same converter the GitHub code-scanning action uses, so if you already upload SARIF you have the file and only need the render step.

Publish it

Drag clippy.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html clippy.html \
        --arg title "Clippy — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

Keep cargo clippy -- -D warnings as its own step if you want the gate. The report step is documentation, not enforcement.

Turning a backlog into work

PATCH one report id per crate and the revision history is the cleanup record — a number that goes down, with the runs that moved it.

Anchored threads on a rule cluster: "we're allowing clippy::too_many_arguments in the FFI module, here's why" — recorded next to the findings rather than only in a #[allow] attribute nobody reads. See commenting on HTML.
A routine re-running weekly, so progress is visible without anyone maintaining a spreadsheet.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total. A first run on a large workspace is the one that gets close — scope it with -p <crate> for the shareable view.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a lint report →