Repository navigation
Add Blinter, a linter for Windows batch files (.bat / .cmd), with native SARIF output #69
Description
Disclosure: I'm the author of Blinter.
What it is
Blinter is a static analysis linter for Windows batch scripts (.bat and .cmd). I couldn't find an existing batch-file linter in codacy's list of supported linters, so this would cover a gap for repos that still ship Windows build, deploy or installer scripts.
Why it fits
- 191 built-in rules across five categories: errors, warnings, style, security and performance
- Each finding has a rule code, line number, explanation and suggested fix
- Native SARIF 2.1.0 output (
--format sarifso results can go straight into code scanning and reporting without a custom parser - Already used by CodeRabbit (docs), so it has been run against real-world repos at scale
- Published on PyPI and has the OpenSSF Best Practices badge
Integration details
| Install | pip install Blinter (also uv tool install Blinter) |
| Python | 3.11+ |
| Files | *.bat, *.cmd |
| Run | blinter <file-or-dir> (recursive by default) |
| Config | blinter.ini, or --config <path> / --no-config |
| SARIF output | blinter <path> --format sarif --output results.sarif (omit --output for stdout) |
| JSON output | --format json and --output <path> |
| Exit codes | 0 = no errors or security findings, 1 = lint failure, 2 = internal error |
| Suppression | inline REM LINT:IGNORE <code> comments |
| License | AGPL-3.0-or-later |
| Platform | Windows, Linux and macOS |
SARIF results use Blinter's rule codes as ruleId, with the explanation and recommendation attached to each rule. Error and Security findings map to error, Warning maps to warning, and Style and Performance map to note. Warnings and style findings don't affect the exit code, so it's easy to gate on errors and security issues only.
Proposal
Add Blinter as a linter for BATCH [or whatever key fits your naming convention], matching *.bat and *.cmd, and enable its SARIF output where codacy supports it.
I'm happy to open the PR myself, including the descriptor, tests and docs, if you can point me to the right contribution guide or a good example to follow. If there's anything that would block inclusion (for example the license or packaging), let me know and I'll see what I can do.
Activity