You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning.md
-2Lines changed: 0 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -169,8 +169,6 @@ This is where you store details of the rules that are run during analysis. Infor
169
169
170
170
Each `result` object contains details for one alert in the codebase. Within the `results` object, you can reference the rule that detected the alert. For more information, see [Rules and results](#rules-and-results) above.
171
171
172
-
{% data reusables.code-scanning.upload-sarif-alert-limit %}
173
-
174
172
| Name | Required | Description |
175
173
|----|----|----|
176
174
| `ruleId`| {% octicon "x" aria-label="Optional" %} | The unique identifier of the rule (`reportingDescriptor.id`). For more information, see the [`reportingDescriptor` object](#reportingdescriptor-object). {% data variables.product.prodname_code_scanning_caps %} uses the rule identifier to filter results by rule on {% data variables.product.prodname_dotcom %}.
Copy file name to clipboardExpand all lines: content/code-security/tutorials/customize-code-scanning/uploading-codeql-analysis-results-to-github.md
+24-33Lines changed: 24 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,54 +17,45 @@ redirect_from:
17
17
contentType: tutorials
18
18
---
19
19
20
-
## About SARIF output
21
-
22
-
{% data variables.product.github %} creates {% data variables.product.prodname_code_scanning %} alerts in a repository using information from Static Analysis Results Interchange Format (SARIF) files. SARIF is designed to represent the output of a broad range of static analysis tools, and there are many features in the SARIF specification that are considered "optional". The results must use SARIF version 2.1.0. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).
23
-
24
-
After analyzing a {% data variables.product.prodname_codeql %} database using the {% data variables.product.prodname_codeql_cli %}, you will have a SARIF file that contains the results. For more information, see [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries). You can then use the {% data variables.product.prodname_codeql_cli %} to upload results to {% data variables.product.github %}.
20
+
After analyzing a {% data variables.product.prodname_codeql %} database using the {% data variables.product.prodname_codeql_cli %}, you will have a SARIF file that contains the results. You can then use the {% data variables.product.prodname_codeql_cli %} to upload results to {% data variables.product.github %}.
25
21
26
22
If you used a method other than the {% data variables.product.prodname_codeql_cli %} to generate results, you can use other upload methods. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github).
27
23
28
-
{% data reusables.code-scanning.upload-sarif-ghas %}
29
-
30
24
## Generating a token for authentication with {% data variables.product.github %}
31
25
32
-
Before you can upload your results to {% data variables.product.github %}, you will first need to generate a {% data variables.product.pat_generic %}.
26
+
Before you can upload your results to {% data variables.product.github %}, you will first need to generate a {% data variables.product.pat_generic %}. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
33
27
34
28
* **{% data variables.product.pat_v1_caps %}** requires "{% data variables.product.prodname_code_scanning_caps %} alerts" **Read and write** access for the required repositories.
35
29
* **{% data variables.product.pat_v2_caps %}** requires "repo" **security_events** access.
36
30
37
-
For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
38
-
39
-
If you have installed the {% data variables.product.prodname_codeql_cli %} in a third-party CI system to create results to display in {% data variables.product.github %} as code scanning alerts, you can use a {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} to upload results to {% data variables.product.github %}. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system#generating-a-token-for-authentication-with-github).
31
+
If you have installed the {% data variables.product.prodname_codeql_cli %} in a third-party CI system, you can also use a {% data variables.product.prodname_github_app %} to upload results to {% data variables.product.github %}. See [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system#generating-a-token-for-authentication-with-github).
40
32
41
33
## Uploading results to {% data variables.product.github %}
42
34
43
-
{% data reusables.code-scanning.upload-sarif-alert-limit %}
35
+
1. {% data reusables.code-scanning.upload-sarif-alert-limit %}
36
+
1. Determine the best way to pass the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} you created in the previous section to the {% data variables.product.prodname_codeql_cli %}. We recommend that you review your CI system's guidance on the secure use of a secret store. The {% data variables.product.prodname_codeql_cli %} supports:
44
37
45
-
Before you can upload results to {% data variables.product.github %}, you must determine the best way to pass the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} you created in the previous section to the {% data variables.product.prodname_codeql_cli %}. We recommend that you review your CI system's guidance on the secure use of a secret store. The {% data variables.product.prodname_codeql_cli %} supports:
38
+
* Interfacing with a secret store using the `--github-auth-stdin` option (recommended).
39
+
* Saving the secret in the environment variable `GITHUB_TOKEN` and running the CLI without including the `--github-auth-stdin` option.
40
+
* For testing purposes you can pass the `--github-auth-stdin` command-line option and supply a temporary token via standard input.
46
41
47
-
* Interfacing with a secret store using the `--github-auth-stdin` option (recommended).
48
-
* Saving the secret in the environment variable `GITHUB_TOKEN` and running the CLI without including the `--github-auth-stdin` option.
49
-
* For testing purposes you can pass the `--github-auth-stdin` command-line option and supply a temporary token via standard input.
42
+
1. When you have decided on the most secure and reliable method for your configuration, run `codeql github upload-results` on each SARIF results file and include `--github-auth-stdin` unless the token is available in the environment variable `GITHUB_TOKEN`.
50
43
51
-
When you have decided on the most secure and reliable method for your configuration, run `codeql github upload-results` on each SARIF results file and include `--github-auth-stdin` unless the token is available in the environment variable `GITHUB_TOKEN`.
44
+
```shell
45
+
# {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} available from a secret store
There is no output from this command unless the upload was unsuccessful. The command prompt returns when the upload is complete and data processing has begun. On smaller codebases, you should be able to explore the {% data variables.product.prodname_code_scanning %} alerts in {% data variables.product.github %} shortly afterward. You can see alerts directly in the pull request or on the **Security** tab for branches, depending on the code you checked out. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests) and [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository).
88
+
There is no output from this command unless the upload was unsuccessful. The command prompt returns when the upload is complete and data processing has begun. On smaller codebases, you should be able to explore the {% data variables.product.prodname_code_scanning %} alerts in {% data variables.product.github %} shortly afterward. You can see alerts directly in the pull request or on the **Security** tab for branches, depending on the code you checked out.
98
89
99
90
## Uploading diagnostic information to {% data variables.product.github %} if the analysis fails
You can check that the SARIF properties have the supported size for upload and that the file is compatible with code scanning. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#file-compatibility).
1
+
Check that the SARIF properties have the supported size for upload and that the file is compatible with code scanning. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#file-compatibility).
0 commit comments