Skip to main content

About integration with code scanning

You can perform code scanning externally and then display the results in GitHub, or set up webhooks that listen to code scanning activity in your repository.

Code scanning está disponível para todos os repositórios públicos no GitHub.com. Para usar code scanning em um repositório privado pertencente a uma organização, você precisa ter um licença do GitHub Advanced Security. Para obter mais informações, confira "Sobre o GitHub Advanced Security".

As an alternative to running code scanning within GitHub, you can perform analysis elsewhere and then upload the results. Alerts for code scanning that you run externally are displayed in the same way as those for code scanning that you run within GitHub. For more information, see "Managing code scanning alerts for your repository."

If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to GitHub. For more information, see "Uploading a SARIF file to GitHub."

Se você executar a verificação de código usando várias configurações, às vezes, um alerta terá várias origens de análise. Se um alerta tiver várias origens de análise, você poderá ver o status do alerta para cada origem de análise na página de alertas. Para obter mais informações, confira "Sobre as origens da análise".

Integrations with webhooks

You can use code scanning webhooks to build or set up integrations, such as GitHub Apps or OAuth Apps, that subscribe to code scanning events in your repository. For example, you could build an integration that creates an issue on GitHub Enterprise Cloud or sends you a Slack notification when a new code scanning alert is added in your repository. For more information, see "Creating webhooks" and "Webhook events and payloads."

Further reading