Question

Your security team ingests SARIF files produced by an external SAST tool into GitHub code scanning using the SARIF upload API. Some large SARIF uploads are being rejected or silently truncated, and developers complain that certain alerts never appear in the Security tab. Which characteristic of GitHub's SARIF ingestion should the team account for to ensure their results are reliably processed?

Accepted Answer

GitHub enforces limits on the SARIF file (such as maximum size and a cap on the number of results and runs per file), so uploads exceeding these thresholds are rejected or have results dropped.

Answer

SARIF files are only accepted if they were generated by CodeQL; third-party SARIF must first be converted to the CodeQL database format before upload.

Answer

GitHub only processes the first SARIF file uploaded per repository per day, so additional uploads within 24 hours are ignored entirely.

Answer

SARIF uploads require the file to be committed into the repository's default branch before the API will index any of its results.