GH-500 · Question #83
What action do you need to include in your workflow to upload a third-party Static Analysis Results Interchange Format (SARIF) file to a repository?
The correct answer is A. upload-sarif. The 'github/codeql-action/upload-sarif' action is specifically designed to upload SARIF files to GitHub, making the results appear in the repository's Security tab under Code scanning alerts. This allows third-party SAST tools (like ESLint, Semgrep, or Snyk) to integrate their…
Question
What action do you need to include in your workflow to upload a third-party Static Analysis Results Interchange Format (SARIF) file to a repository?
Options
- Aupload-sarif
- BpartialFingerprints
- Cdependency-review
- Dscheduled
How the community answered
(27 responses)- A93% (25)
- B4% (1)
- D4% (1)
Explanation
The 'github/codeql-action/upload-sarif' action is specifically designed to upload SARIF files to GitHub, making the results appear in the repository's Security tab under Code scanning alerts. This allows third-party SAST tools (like ESLint, Semgrep, or Snyk) to integrate their findings into GitHub's unified security dashboard by outputting results in SARIF format and then using this action to submit them. 'partialFingerprints' (option B) is a SARIF file property used to de-duplicate results, not a workflow action. 'dependency-review' (option C) is a separate action for reviewing dependency changes in pull requests. 'scheduled' (option D) is a trigger event type in GitHub Actions, not an action.
Topics
Community Discussion
No community discussion yet for this question.