Upload finalized SARIF files to GitHub Advanced Security via Sarif.Multitool.
npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghas
Please help me install this Agent Skill. Skill: publish-to-ghas Source: https://github.com/microsoft/sarif-sdk/tree/main/skills/publish-to-ghas Command: npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghas
Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.
Run the Sarif.Multitool publish-to-ghas command with your finalized SARIF file and a token stored in an environment variable.
High-intent search queries and answers about installing and using this skill.
To upload a finalized SARIF file to GitHub Advanced Security, use the Sarif.Multitool publish-to-ghas verb with a token supplied via an environment variable. The tool automatically derives the GitHub target owner, repo, commit SHA, and ref from version-control provenance.
Uploading SARIF to GHAS does not require manual repository or commit configuration. The process derives the GitHub target owner, repo, commit SHA, and ref directly from the run's version-control provenance, ensuring secure and accurate targeting.
If your SARIF file is not finalized with repository provenance, the upload to GHAS will fail safely. The skill enforces that the SARIF was finalized with repository provenance and that the run is hosted on GitHub or a GitHub Enterprise host before proceeding.
Publishing SARIF to GitHub Advanced Security fails safely outside GitHub environments because it requires the run to be hosted on GitHub or a GitHub Enterprise host. This validation ensures version-control provenance is valid before securely uploading code scanning results.
You can automate uploading SARIF results to GHAS in your CI workflows by running the Sarif.Multitool publish-to-ghas command. It requires a finalized SARIF file and a token stored in an environment variable to publish results for security monitoring.
microsoftPublish finalized SARIF files to GitHub Advanced Security for Azure DevOps.
Hack23Automate secure CI/CD pipelines with GitHub Actions for testing, scanning, and deployment.
microsoftSerialize AI-generated security findings as SARIF v2.1.0 logs.
microsoftValidate SARIF files against the SARIF 2.1.0 schema and AI profile rules.
