JVM Sentinel

JVM Sentinel scans Java projects for upgrade risk, compliance drift, and Oracle migration issues.

It ships three analyzers on one engine.

• sentinel-core owns project scanning, bytecode parsing, dependency resolution, and the shared model.
• sentinel-report renders console, HTML, JSON, and SARIF output.
• sentinel-cli runs scans from the terminal.
• sentinel-gradle-plugin wires the same scan into ./gradlew sentinelScan.
• sentinel-github-action wraps the CLI for CI.

The engine scans source files, class files, build files, and dependency declarations once, then feeds the same ScanTarget into every analyzer. That keeps the report aligned across the CLI, Gradle plugin, and GitHub Action.

Layout

See docs/architecture/adr/0001-plugin-based-analyzers.md for the plugin boundary and docs/report-formats.md for output details.

Run it

Scan the current project:

./gradlew :sentinel-cli:run --args="scan -p ."

Write SARIF for GitHub code scanning:

./gradlew :sentinel-cli:run --args="scan -p . -f sarif -o sentinel.sarif"

Run a focused check:

./gradlew :sentinel-cli:run --args="upgrade -p ."

Publish

Tagged releases publish module jars to GitHub Packages and attach the CLI distribution zip to the GitHub release. Use tags like v0.1.0 and let .github/workflows/release.yml do the rest.