GH-500 · Question #66
What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?
The correct answer is C. Update the workflow to include a final step that uploads the results. When running a third-party SARIF-compatible static analysis tool in GitHub Actions, you must explicitly add a final workflow step that uploads the generated SARIF file to GitHub using the github/codeql-action/upload-sarif action. Unlike the native CodeQL action, third-party…
Question
What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?
Options
- AThe CodeQL action uploads the SARIF file automatically when it completes analysis.
- BUse the CLI to upload results to GitHub.
- CUpdate the workflow to include a final step that uploads the results.
- DBy default, the CodeQL runner automatically uploads results to GitHub on completion.
How the community answered
(15 responses)- A13% (2)
- C80% (12)
- D7% (1)
Explanation
When running a third-party SARIF-compatible static analysis tool in GitHub Actions, you must explicitly add a final workflow step that uploads the generated SARIF file to GitHub using the github/codeql-action/upload-sarif action. Unlike the native CodeQL action, third-party tools do not auto-upload results. The CodeQL runner auto-upload behavior described in option D applies only to the CodeQL runner, not to generic SARIF-compatible tools run manually in a workflow.
Topics
Community Discussion
No community discussion yet for this question.