A custom linter produces SARIF. Which Actions-oriented approach publishes those results to GitHub code scanning alerts?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Generate SARIF in CI and upload via the code scanning upload action/API. Mere commits of SARIF, secrets storage, or log warnings do not create first-class code scanning alerts.
Full explanation below image
Full Explanation
GitHub code scanning accepts SARIF from CodeQL analysis and from third-party tools. In Actions, a typical advanced setup runs the tool then uses github/codeql-action/upload-sarif with appropriate permissions (security-events: write). Results appear as code scanning alerts and PR annotations integrated with the Security UI. Simply committing SARIF without upload configuration does not reliably create managed alerts. Secrets are for credentials, not SARIF transport. Workflow commands like ::warning:: create log annotations but are not a substitute for the code scanning store. Default CodeQL setup may not need a custom workflow, but custom linters do. Ensure SARIF version compatibility and category names when multiple tools upload.