This content describes the most recent release of the CodeQL CLI. For more information about this release, see https://github.com/github/codeql-cli-binaries/releases.
To see details of the options available for this command in an earlier release, run the command with the
--help option in your terminal.
codeql github upload-results --sarif=<file> [--github-auth-stdin] [--github-url=<url>] [--repository=<repository-name>] [--ref=<ref>] [--commit=<commit>] [--checkout-path=<path>] <options>...
Uploads a SARIF file to GitHub code scanning.
A GitHub Apps token or personal access token must be set. For best
security practices, it is recommended to set the
flag and pass the token to the command through standard input.
GITHUB_TOKEN environment variable can be set.
This token must have the
[Mandatory] Path to the SARIF file to upload. This should be the
output of codeql database analyze (or codeql database interpret-results) with
--format sarif-latest for upload to github.com or
GitHub AE, or the appropriate supported format tag for GitHub Enterprise
Server instances (see https://docs.github.com/ for the right value for
GitHub repository owner and name (e.g., github/octocat) to use as an endpoint for uploading. The CLI will attempt to autodetect this from the checkout path if it is omitted.
Name of the ref that was analyzed. If this ref is a pull request merge commit, then use refs/pulls/1234/merge or refs/pulls/1234/head (depending on whether or not this commit corresponds to the HEAD or MERGE commit of the PR). Otherwise, this should be a branch: refs/heads/branch-name. If omitted, the CLI will attempt to automatically populate this from the current branch of the checkout path, if this exists.
SHA of commit that was analyzed. If this is omitted the CLI will attempt to autodetect this from the checkout path.
Checkout path. Default is the current working directory.
[Advanced] Allow more than one SARIF file to be specified, and merge these into a single file before uploading. This is only recommended for backwards compatibility. For new analyses it is recommended to upload two separate SARIF files with different categories. This option only works in conjunction with SARIF files produced by CodeQL with SARIF version 2.1.0 (this is the default version of SARIF used by CodeQL).
Select output format. Choices include:
text (default): Print the URL for tracking the status of the SARIF
json: Print the response body of the SARIF upload API request.
See also: https://docs.github.com/en/rest/reference/code-scanning#upload-an-analysis-as-sarif-data
Options to configure where to upload SARIF files.
Accept a GitHub Apps token or personal access token via standard input.
This overrides the GITHUB_TOKEN environment variable.
URL of the GitHub instance to use. If omitted, the CLI will attempt to autodetect this from the checkout path and if this is not possible default to https://github.com/
Show this help text.
[Advanced] Give option to the JVM running the command.
(Beware that options containing spaces will not be handled correctly.)
Incrementally increase the number of progress messages printed.
Incrementally decrease the number of progress messages printed.
[Advanced] Explicitly set the verbosity level to one of errors,
warnings, progress, progress+, progress++, progress+++. Overrides
[Advanced] Write detailed logs to one or more files in the given directory, with generated names that include timestamps and the name of the running subcommand.
(To write a log file with a name you have full control over, instead
--log-to-stderr and redirect stderr as desired.)