Skip to main content

About integration with code scanning

You can perform 代码扫描 externally and then display the results in GitHub, or set up webhooks that listen to 代码扫描 activity in your repository.

代码扫描 is available for all public repositories on GitHub.com. 代码扫描 is also available for private repositories owned by organizations that use GitHub Enterprise Cloud and have a license for GitHub Advanced Security. 更多信息请参阅“GitHub 的产品”。

As an alternative to running 代码扫描 within GitHub, you can perform analysis elsewhere and then upload the results. Alerts for 代码扫描 that you run externally are displayed in the same way as those for 代码扫描 that you run within GitHub. For more information, see "Managing 代码扫描 alerts for your repository."

If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to GitHub. For more information, see "Uploading a SARIF file to GitHub."

如果使用多个配置运行代码扫描,则有时警报将具有多个分析源。 如果一个警报有多个分析源,您可以在警报页面上查看每个分析源的警报状态。 更多信息请参阅“关于分析源”。

Integrations with webhooks

You can use 代码扫描 webhooks to build or set up integrations, such as GitHub 应用程序 or OAuth 应用程序, that subscribe to 代码扫描 events in your repository. For example, you could build an integration that creates an issue on GitHub or sends you a Slack notification when a new 代码扫描 alert is added in your repository. For more information, see "Creating webhooks" and "Webhook events and payloads."

Further reading