GH-500 · Question #121
To be compatible with code scanning, what data format must third-party code scanning tools use for output?
The correct answer is C. Static Analysis Results Interchange Format (SARIF). GitHub's code scanning feature is built around SARIF (Static Analysis Results Interchange Format), an OASIS standard JSON-based format for representing static analysis tool output. Third-party tools (such as Semgrep, Checkmarx, or Fortify) must export their results as SARIF…
Question
To be compatible with code scanning, what data format must third-party code scanning tools use for output?
Options
- AESLint
- BYAML
- CStatic Analysis Results Interchange Format (SARIF)
- Dcomma separated values (CSV)
How the community answered
(24 responses)- C96% (23)
- D4% (1)
Explanation
GitHub's code scanning feature is built around SARIF (Static Analysis Results Interchange Format), an OASIS standard JSON-based format for representing static analysis tool output. Third-party tools (such as Semgrep, Checkmarx, or Fortify) must export their results as SARIF files (.sarif or .sarif.json) before uploading to GitHub via the upload-sarif action or the code scanning API. ESLint is a linting tool, not an output format. YAML is a configuration serialization language. CSV is a plain-text tabular format that GitHub code scanning does not accept for results ingestion.
Topics
Community Discussion
No community discussion yet for this question.