Question

Your organization runs CodeQL analysis on a self-hosted Jenkins pipeline instead of GitHub Actions because your build toolchain is highly customized. After the CodeQL CLI produces a `results.sarif` file, the team needs those results to appear as code scanning alerts in the repository's Security tab on GitHub.com. Which approach correctly delivers the SARIF results into GitHub code scanning?

Accepted Answer

Upload the SARIF file using the CodeQL CLI's `github upload-results` command (or the code scanning SARIF upload API endpoint) with a token that has the `security_events` write scope.

Answer

Commit the `results.sarif` file to the repository's default branch so GitHub automatically parses it into alerts.

Answer

Open a support ticket with GitHub to manually import the SARIF file, since external CI results cannot be ingested programmatically.

Answer

Convert the SARIF file to the Dependabot alert format and submit it via the Dependency Submission API.