nerdexam
Microsoft

GH-500 · Question #121

To be compatible with code scanning, what data format must third-party code scanning tools use for output?

The correct answer is C. Static Analysis Results Interchange Format (SARIF). GitHub's code scanning feature is built around SARIF (Static Analysis Results Interchange Format), an OASIS standard JSON-based format for representing static analysis tool output. Third-party tools (such as Semgrep, Checkmarx, or Fortify) must export their results as SARIF…

Code Scanning

Question

To be compatible with code scanning, what data format must third-party code scanning tools use for output?

Options

  • AESLint
  • BYAML
  • CStatic Analysis Results Interchange Format (SARIF)
  • Dcomma separated values (CSV)

How the community answered

(24 responses)
  • C
    96% (23)
  • D
    4% (1)

Explanation

GitHub's code scanning feature is built around SARIF (Static Analysis Results Interchange Format), an OASIS standard JSON-based format for representing static analysis tool output. Third-party tools (such as Semgrep, Checkmarx, or Fortify) must export their results as SARIF files (.sarif or .sarif.json) before uploading to GitHub via the upload-sarif action or the code scanning API. ESLint is a linting tool, not an output format. YAML is a configuration serialization language. CSV is a plain-text tabular format that GitHub code scanning does not accept for results ingestion.

Topics

#Code Scanning#SARIF#Third-party tools#Interoperability

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice