nerdexam
Microsoft

GH-500 · Question #66

What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?

The correct answer is C. Update the workflow to include a final step that uploads the results. When running a third-party SARIF-compatible static analysis tool in GitHub Actions, you must explicitly add a final workflow step that uploads the generated SARIF file to GitHub using the github/codeql-action/upload-sarif action. Unlike the native CodeQL action, third-party…

Code Scanning

Question

What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?

Options

  • AThe CodeQL action uploads the SARIF file automatically when it completes analysis.
  • BUse the CLI to upload results to GitHub.
  • CUpdate the workflow to include a final step that uploads the results.
  • DBy default, the CodeQL runner automatically uploads results to GitHub on completion.

How the community answered

(15 responses)
  • A
    13% (2)
  • C
    80% (12)
  • D
    7% (1)

Explanation

When running a third-party SARIF-compatible static analysis tool in GitHub Actions, you must explicitly add a final workflow step that uploads the generated SARIF file to GitHub using the github/codeql-action/upload-sarif action. Unlike the native CodeQL action, third-party tools do not auto-upload results. The CodeQL runner auto-upload behavior described in option D applies only to the CodeQL runner, not to generic SARIF-compatible tools run manually in a workflow.

Topics

#SARIF#GitHub Actions#Code Scanning#Workflow configuration

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice