Export SARIF from an offline SAST scan

What SARIF is, in one paragraph

SARIF (Static Analysis Results Interchange Format) is an OASIS standard — currently version 2.1.0 — for representing the output of static analysis tools in a single JSON schema. Instead of every scanner inventing its own report format, tools that speak SARIF plug directly into GitHub Code Scanning, GitLab SAST, Azure DevOps and most security dashboards without a custom parser. It groups findings under a tool.driver.rules array (rule metadata) and a results array (each finding: rule ID, severity, file, line, message).

What the file actually contains

A trimmed real example — one finding, produced by scanning a two-line vulnerable snippet:

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [{
    "tool": {
      "driver": {
        "name": "StaticCodeAudit",
        "version": "1.0.0",
        "informationUri": "https://codefixture.com",
        "rules": [{
          "id": "hardcoded_secret",
          "name": "Hardcoded secret",
          "fullDescription": { "text": "Plain text secrets in code can be exposed via Git repository." },
          "defaultConfiguration": { "level": "error" }
        }]
      }
    },
    "results": [{
      "ruleId": "hardcoded_secret",
      "level": "error",
      "message": { "text": "Plain text secrets in code can be exposed via Git repository." },
      "locations": [{
        "physicalLocation": {
          "artifactLocation": { "uri": "app.py" },
          "region": { "startLine": 6 }
        }
      }],
      "fixes": [{ "description": { "text": "Use environment variables or system_configs in database." } }]
    }]
  }]
}

Every result carries a file path, a line number, and — where a remediation is known — a fixes entry with a plain-language suggestion. GitHub Code Scanning renders all of this directly on the Security tab, annotated on the exact line in the diff view.

Wiring it into GitHub Code Scanning

GitHub's own upload-sarif action reads any SARIF 2.1.0 file, regardless of which tool produced it. A minimal workflow step:

- name: Run StaticCodeAudit
  run: ./staticcodeaudit-linux-x86_64 /path/to/project --sarif --fail-on-high

- name: Upload SARIF to GitHub Code Scanning
  if: always()
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: docs/audit-reports/*.sarif

if: always() matters here: without it, a HIGH finding (which makes the previous step exit 1) would skip the upload step and you would never see the results in the Security tab — you would only know the pipeline failed, not why.

Frequently asked questions