Question

Your team runs a proprietary static analysis tool in an external Jenkins pipeline, not on GitHub Actions. You want the tool's findings to appear as code scanning alerts in the GitHub Security tab of your repository, tracked alongside CodeQL results. The tool can export its findings to a standardized file format. What is the correct approach to get these findings into GitHub code scanning?

Accepted Answer

Have the tool produce a SARIF file and upload it to GitHub using the code scanning SARIF upload API (or the upload-sarif action), so the results appear as code scanning alerts.

Answer

Convert the tool's output to a Dependabot-compatible manifest and submit it through the Dependency Submission API.

Answer

Configure the tool to write JSON output to the repository, and GitHub will automatically detect and import it during the next push.

Answer

Third-party tools running outside GitHub Actions cannot post to code scanning; you must migrate the analysis to a GitHub Actions workflow using CodeQL.