Uploading SARIF

For the broader CI / GitOps / agentic playbook, see CI/CD & workflow integration.

With the Action

- uses: sgoveia/cryptarium@v0.3.0
  with:
    path: .
    fail-on: critical
    upload-sarif: true

Ensure the workflow (or job) has security-events: write so the upload can create code scanning alerts. Results appear under Security → Code scanning for the repository, filtered by tool cryptarium (category: cryptarium). They do not appear under Dependabot, secret scanning, or Code quality. Prerequisites

Public repositories: third-party SARIF upload is supported once the workflow uploads successfully.
Private or internal repositories: GitHub Code Security must be enabled for the repository (or organization).

Manual

cryptarium scan --format sarif --output results.sarif .

Upload results.sarif with github/codeql-action/upload-sarif@v4 (set category: cryptarium) or your platform’s SARIF ingest.