publish-to-ghas

Name: publish-to-ghas
Availability: InStock
Author: Microsoft

Upload finalized SARIF files to GitHub Advanced Security via Sarif.Multitool.

224|105|Updated Nov 5, 2015

Search Tags:#automation #provenance #code-scanning #sarif #finalize #ghas #sarif.multitool

Ready to run

npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghas

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: publish-to-ghas
Source: https://github.com/microsoft/sarif-sdk/tree/main/skills/publish-to-ghas
Command: npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghas

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.

Core Features & Use Cases

Automates uploading a finalized SARIF to GHAS via the publish-to-ghas verb.
Derives the GitHub owner/repo, the commit SHA, and the ref from version-control provenance and requires a token stored in an environment variable.
Suitable for CI workflows that finalize SARIF results and publish them to GitHub for security monitoring.

Quick Start

Run the Sarif.Multitool publish-to-ghas command with your finalized SARIF file and a token stored in an environment variable.

Frequently Asked Questions about publish-to-ghas

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I upload a finalized SARIF file to GitHub Advanced Security code scanning?▼

To upload a finalized SARIF file to GitHub Advanced Security, use the Sarif.Multitool publish-to-ghas verb with a token supplied via an environment variable. The tool automatically derives the GitHub target owner, repo, commit SHA, and ref from version-control provenance.

Does uploading SARIF to GHAS require manual repository and commit configuration?▼

Uploading SARIF to GHAS does not require manual repository or commit configuration. The process derives the GitHub target owner, repo, commit SHA, and ref directly from the run's version-control provenance, ensuring secure and accurate targeting.

What happens if my SARIF file is not finalized with repository provenance?▼

If your SARIF file is not finalized with repository provenance, the upload to GHAS will fail safely. The skill enforces that the SARIF was finalized with repository provenance and that the run is hosted on GitHub or a GitHub Enterprise host before proceeding.

Why does publishing SARIF to GitHub Advanced Security fail safely outside of GitHub environments?▼

Publishing SARIF to GitHub Advanced Security fails safely outside GitHub environments because it requires the run to be hosted on GitHub or a GitHub Enterprise host. This validation ensures version-control provenance is valid before securely uploading code scanning results.

Can I automate uploading SARIF results to GHAS in my CI workflows?▼

You can automate uploading SARIF results to GHAS in your CI workflows by running the Sarif.Multitool publish-to-ghas command. It requires a finalized SARIF file and a token stored in an environment variable to publish results for security monitoring.