您可以通过将数据上传为 SARIF 文件来集成第三方代码分析工具与 GitHub code scanning。
Code scanning is available for all public repositories on GitHub.com. Code scanning is also available for private repositories owned by organizations that use GitHub Enterprise Cloud and have a license for GitHub Advanced Security. 有关详细信息，请参阅“关于 GitHub Advanced Security”。
You can perform code scanning externally and then display the results in GitHub, or set up webhooks that listen to code scanning activity in your repository.
您可以将 SARIF 文件从第三方静态分析工具上传到 GitHub，并且在仓库中看到 code scanning 来自这些工具的警报。
To display results from a third-party static analysis tool in your repository on GitHub, you'll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default CodeQL static analysis engine, then your results will display in your repository on GitHub automatically.