{"meta":{"title":"Отправка файла SARIF в GitHub","intro":"You can upload SARIF files generated outside GitHub and see code scanning alerts from third-party tools in your repository.","product":"Безопасность и качество кода","breadcrumbs":[{"href":"/ru/code-security","title":"Безопасность и качество кода"},{"href":"/ru/code-security/code-scanning","title":"Проверка кода"},{"href":"/ru/code-security/code-scanning/integrating-with-code-scanning","title":"Интеграция со сканированием кода"},{"href":"/ru/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github","title":"Отправка ФАЙЛА SARIF"}]},"body":"<!-- TRANSLATION_FALLBACK prop=markdown type=ParseError line=2 col=1 msg=\"tag 'данные' not found\" -->\n## About SARIF file uploads for code scanning\n\nGitHub creates code scanning alerts in a repository using information from Static Analysis Results Interchange Format (SARIF) files. SARIF files can be uploaded to a repository using the API or GitHub Actions. For more information, see [Using code scanning with your existing CI system](/en/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system).\n\nYou can generate SARIF files using many static analysis security testing tools, including CodeQL. The results must use SARIF version 2.1.0. For more information, see [SARIF support for code scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).\n\nYou can upload the results using GitHub Actions, the code scanning API, or the CodeQL CLI. The best upload method will depend on how you generate the SARIF file, for example, if you use:\n\n* GitHub Actions to run the CodeQL action, there is no further action required. The CodeQL action uploads the SARIF file automatically when it completes analysis.\n* GitHub Actions to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).\n* The CodeQL CLI to run code scanning in your CI system, you can use the CLI to upload results to GitHub (for more information, see [Using code scanning with your existing CI system](/en/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system)).\n* A tool that generates results as an artifact outside of your repository, you can use the code scanning API to upload the file (for more information, see [REST API endpoints for code scanning](/en/rest/code-scanning/code-scanning#upload-an-analysis-as-sarif-data)).\n\n> \\[!NOTE]\n> For private and internal repositories, code scanning is available when GitHub Code Security features are enabled for the repository. If you see the error `GitHub Code Security or GitHub Advanced Security must be enabled for this repository to use code scanning`, check that GitHub Code Security is enabled. For more information, see [Managing security and analysis settings for your repository](/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository).\n\n## Uploading a code scanning analysis with GitHub Actions\n\nTo use GitHub Actions to upload a third-party SARIF file to a repository, you'll need a workflow. For more information, see [Writing workflows](/en/actions/learn-github-actions).\n\nYour workflow will need to use the `upload-sarif` action, which is part of the `github/codeql-action` repository. It has input parameters that you can use to configure the upload. The main input parameters you'll use are:\n\n* `sarif_file`, which configures the file or directory of SARIF files to be uploaded. The directory or file path is relative to the root of the repository.\n* `category` (optional), which assigns a category for results in the SARIF file. This enables you to analyze the same commit in multiple ways and review the results using the code scanning views in GitHub. For example, you can analyze using multiple tools, and in mono-repos, you can analyze different slices of the repository based on the subset of changed files.\n\nFor more information, see the [`upload-sarif` action](https://github.com/github/codeql-action/tree/v4/upload-sarif).\n\nThe `upload-sarif` action can be configured to run when the `push` and `scheduled` event occur. For more information about GitHub Actions events, see [Events that trigger workflows](/en/actions/using-workflows/events-that-trigger-workflows).\n\nIf your SARIF file doesn't include `partialFingerprints`, the `upload-sarif` action will calculate the `partialFingerprints` field for you and attempt to prevent duplicate alerts. GitHub can only create `partialFingerprints` when the repository contains both the SARIF file and the source code used in the static analysis. For more information about preventing duplicate alerts, see [SARIF support for code scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#providing-data-to-track-code-scanning-alerts-across-runs).\n\nYou can check that the SARIF properties have the supported size for upload and that the file is compatible with code scanning. For more information, see [SARIF support for code scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#validating-your-sarif-file).\n\n### Example workflow for SARIF files generated outside of a repository\n\nYou can create a new workflow that uploads SARIF files after you commit them to your repository. This is useful when the SARIF file is generated as an artifact outside of your repository.\n\nThis example workflow runs anytime commits are pushed to the repository. The action uses the `partialFingerprints` property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see [Events that trigger workflows](/en/actions/using-workflows/events-that-trigger-workflows).\n\nThis workflow uploads the `results.sarif` file located in the root of the repository. For more information about creating a workflow file, see [Writing workflows](/en/actions/learn-github-actions).\n\nAlternatively, you could modify this workflow to upload a directory of SARIF files. For example, you could place all SARIF files in a directory in the root of your repository called `sarif-output` and set the action's input parameter `sarif_file` to `sarif-output`. Note that if you upload a directory, each SARIF file must include a unique `runAutomationDetails.id` to define the category for the results. For more information, see [SARIF support for code scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#runautomationdetails-object).\n\n```yaml\nname: \"Upload SARIF\"\n\n# Run workflow each time code is pushed to your repository and on a schedule.\n# The scheduled workflow runs every Thursday at 15:45 UTC.\non:\n  push:\n  schedule:\n    - cron: '45 15 * * 4'\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      # required for all workflows\n      security-events: write\n      # only required for workflows in private repositories\n      actions: read\n      contents: read\n    steps:\n      # This step checks out a copy of your repository.\n      - name: Checkout repository\n        uses: actions/checkout@v5\n      - name: Upload SARIF file\n        uses: github/codeql-action/upload-sarif@v4\n        with:\n          # Path to SARIF file relative to the root of the repository\n          sarif_file: results.sarif\n          # Optional category for the results\n          # Used to differentiate multiple results for one commit\n          category: my-analysis-tool\n```\n\n### Example workflow that runs the ESLint analysis tool\n\nIf you generate your third-party SARIF file as part of a continuous integration (CI) workflow, you can add the `upload-sarif` action as a step after running your CI tests. If you don't already have a CI workflow, you can create one using a GitHub Actions template. For more information, see the [Quickstart for GitHub Actions](/en/actions/quickstart).\n\nThis example workflow runs anytime commits are pushed to the repository. The action uses the `partialFingerprints` property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see [Events that trigger workflows](/en/actions/using-workflows/events-that-trigger-workflows).\n\nThe workflow shows an example of running the ESLint static analysis tool as a step in a workflow. The `Run ESLint` step runs the ESLint tool and outputs the `results.sarif` file. The workflow then uploads the `results.sarif` file to GitHub using the `upload-sarif` action. For more information about creating a workflow file, see [Understanding GitHub Actions](/en/actions/learn-github-actions/understanding-github-actions).\n\n```yaml\nname: \"ESLint analysis\"\n\n# Run workflow each time code is pushed to your repository and on a schedule.\n# The scheduled workflow runs every Wednesday at 15:45 UTC.\non:\n  push:\n  schedule:\n    - cron: '45 15 * * 3'\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      # required for all workflows\n      security-events: write\n      # only required for workflows in private repositories\n      actions: read\n      contents: read\n    steps:\n      - uses: actions/checkout@v5\n      - name: Run npm install\n        run: npm install\n      # Runs the ESlint code analysis\n      - name: Run ESLint\n        # eslint exits 1 if it finds anything to report\n        run: node_modules/.bin/eslint build docs lib script spec-main -f node_modules/@microsoft/eslint-formatter-sarif/sarif.js -o results.sarif || true\n      # Uploads results.sarif to GitHub repository using the upload-sarif action\n      - uses: github/codeql-action/upload-sarif@v4\n        with:\n          # Path to SARIF file relative to the root of the repository\n          sarif_file: results.sarif\n```\n\n## Further reading\n\n* [Troubleshooting SARIF uploads](/en/code-security/code-scanning/troubleshooting-sarif-uploads)\n* [Workflow syntax for GitHub Actions](/en/actions/using-workflows/workflow-syntax-for-github-actions)\n* [Viewing workflow run history](/en/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history)\n* [Using code scanning with your existing CI system](/en/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system)\n* [REST API endpoints for code scanning](/en/rest/code-scanning/code-scanning#upload-an-analysis-as-sarif-data)"}