Skip to main content

​
SARIF

Purpose: Static Analysis Results Interchange Format output for GitHub Security and any SARIF viewer. When to use: Inline findings in pull requests, gate builds, or archive scan results in a standard results format.

​
Example

With the GitHub Action and upload-sarif: true, results appear in the repository Security tab. See Uploading SARIF.

​
Caveats

  • Pair SARIF with --fail-on when you want a non-zero exit on severity thresholds (CI with —fail-on).
  • Finding text stays plain and specific — location, class, recommendation, confidence — not alarmist marketing copy.