Nota: Tu administrador de sitio debe habilitar el escaneo de código para tu instancia de GitHub Enterprise Server antes de que puedas utilizar esta característica. Para obtener más información, consulta "Configurar el escaneo de código en tu aplicativo."
About SARIF file uploads for escaneo de código
GitHub creates escaneo de código alerts in a repository using information from Static Analysis Results Interchange Format (SARIF) files. SARIF files can be uploaded to a repository using the API or GitHub Actions. For more information, see "Managing escaneo de código alerts for your repository."
You can generate SARIF files using many static analysis security testing tools, including CodeQL. The results must use SARIF version 2.1.0. For more information, see "SARIF support for escaneo de código."
You can upload the results using GitHub Actions, the escaneo de código API, the Ejecutor de CodeQL, or the CodeQL CLI. The best upload method will depend on how you generate the SARIF file, for example, if you use:
- GitHub Actions to run the CodeQL action, there is no further action required. The CodeQL action uploads the SARIF file automatically when it completes analysis.
- GitHub Actions to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).
- The CodeQL CLI to run escaneo de código in your CI system, you can use the CLI to upload results to GitHub (for more information, see "Installing CodeQL CLI in your CI system").
- The Ejecutor de CodeQL, to run escaneo de código in your CI system, by default the runner automatically uploads results to GitHub on completion. If you block the automatic upload, when you are ready to upload results you can use the
upload
command (for more information, see "Running Ejecutor de CodeQL in your CI system"). - A tool that generates results as an artifact outside of your repository, you can use the escaneo de código API to upload the file (for more information, see "Upload an analysis as SARIF data").
Uploading a escaneo de código analysis with GitHub Actions
To use GitHub Actions to upload a third-party SARIF file to a repository, you'll need a workflow. For more information, see "Learn GitHub Actions."
Your workflow will need to use the upload-sarif
action, which is part of the github/codeql-action
repository. It has input parameters that you can use to configure the upload. The main input parameters you'll use are:
sarif-file
, which configures the file or directory of SARIF files to be uploaded. The directory or file path is relative to the root of the repository.category
(optional), which assigns a category for results in the SARIF file. This enables you to analyze the same commit in multiple ways and review the results using the escaneo de código views in GitHub. For example, you can analyze using multiple tools, and in mono-repos, you can analyze different slices of the repository based on the subset of changed files.
For more information see the upload-sarif
action.
The upload-sarif
action can be configured to run when the push
and scheduled
event occur. For more information about GitHub Actions events, see "Events that trigger workflows."
If your SARIF file doesn't include partialFingerprints
, the upload-sarif
action will calculate the partialFingerprints
field for you and attempt to prevent duplicate alerts. GitHub can only create partialFingerprints
when the repository contains both the SARIF file and the source code used in the static analysis. For more information about preventing duplicate alerts, see "About SARIF support for code scanning."
Notas:
-
La carga de SARIF es compatible con un máximo de 5000 resultados por carga. Cualquier resultado que sobrepase este límite se ignorará. Si una herramienta genera demasiados resultados, debes actualizar la configuración para enfocarte en los resultados de las reglas o consultas más importantes.
-
Para cada carga, la carga de SARIF es compatible con un tamaño máximo de 10 MB para el archivo comprimido de
gzip
. Cualquier carga que esté sobre este límite, se rechazará. Si tu archivo SARIF es demasiado grande porque contiene demasiados resultados, debes actualizar la configuración para enfocarte en los resultados de las reglas o consultas más importantes.
Example workflow for SARIF files generated outside of a repository
You can create a new workflow that uploads SARIF files after you commit them to your repository. This is useful when the SARIF file is generated as an artifact outside of your repository.
This example workflow runs anytime commits are pushed to the repository. The action uses the partialFingerprints
property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see "Events that trigger workflows."
This workflow uploads the results.sarif
file located in the root of the repository. For more information about creating a workflow file, see "Learn GitHub Actions."
Alternatively, you could modify this workflow to upload a directory of SARIF files. For example, you could place all SARIF files in a directory in the root of your repository called sarif-output
and set the action's input parameter sarif_file
to sarif-output
. Note that if you upload a directory, each SARIF file must include a unique runAutomationDetails.id
to define the category for the results. For more information, see "runAutomationDetails
object."
name: "Upload SARIF"
# Run workflow each time code is pushed to your repository and on a schedule.
# The scheduled workflow runs every Thursday at 15:45 UTC.
on:
push:
schedule:
- cron: '45 15 * * 4'
jobs:
build:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Checkout repository
uses: actions/checkout@v2
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v1
with:
# Path to SARIF file relative to the root of the repository
sarif_file: results.sarif
# Optional category for the results
# Used to differentiate multiple results for one commit
category: my-analysis-tool
Example workflow that runs the ESLint analysis tool
If you generate your third-party SARIF file as part of a continuous integration (CI) workflow, you can add the upload-sarif
action as a step after running your CI tests. If you don't already have a CI workflow, you can create one using a GitHub Actions template. For more information, see the "GitHub Actions quickstart."
This example workflow runs anytime commits are pushed to the repository. The action uses the partialFingerprints
property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see "Events that trigger workflows."
The workflow shows an example of running the ESLint static analysis tool as a step in a workflow. The Run ESLint
step runs the ESLint tool and outputs the results.sarif
file. The workflow then uploads the results.sarif
file to GitHub using the upload-sarif
action. For more information about creating a workflow file, see "Introduction to GitHub Actions."
name: "ESLint analysis"
# Run workflow each time code is pushed to your repository and on a schedule.
# The scheduled workflow runs every Wednesday at 15:45 UTC.
on:
push:
schedule:
- cron: '45 15 * * 3'
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Run npm install
run: npm install
# Runs the ESlint code analysis
- name: Run ESLint
# eslint exits 1 if it finds anything to report
run: node_modules/.bin/eslint build docs lib script spec-main -f node_modules/@microsoft/eslint-formatter-sarif/sarif.js -o results.sarif || true
# Uploads results.sarif to GitHub repository using the upload-sarif action
- uses: github/codeql-action/upload-sarif@v1
with:
# Path to SARIF file relative to the root of the repository
sarif_file: results.sarif