Integrating with code scanning
You can integrate third-party code analysis tools with GitHub code scanning by uploading data as SARIF files.
Code scanning is available for organization-owned repositories in GitHub Enterprise Server. This feature requires a license for GitHub Advanced Security. For more information, see "About GitHub Advanced Security."
You can perform code scanning externally and then display the results in GitHub, or configure webhooks that listen to code scanning activity in your repository.
You can analyze your code with the CodeQL CLI or another tool in a third-party continuous integration system and upload the results to your GitHub Enterprise Server instance. The resulting code scanning alerts are shown alongside any alerts generated within GitHub Enterprise Server.
You can upload SARIF files generated outside GitHub and see code scanning alerts from third-party tools in your repository.
To display results from a third-party static analysis tool in your repository on GitHub, you'll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default CodeQL static analysis engine, then your results will display in your repository on GitHub automatically.