You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Are SARIF uploads from private repos only available to enterprise users? #943
I'm using an open source SAST scanner that generates SARIF files and as far as I understood, I would be able to upload the SARIF files using github/codeql-action/upload-sarif without having to be an enterprise user/paying for CodeQL since I'm not using the service. Was I mistaken? Can I not upload the reports to and view them under the Security tab? I'm getting an error in my workflow saying HttpError: Resource not accessible by integration. If it's the case that it's not available for private repos except for enterprise users, that is deeply unfortunate.
Note: For private and internal repositories, code scanning is available when GitHub Advanced Security features are enabled for the repository. If you see the error Advanced Security must be enabled for this repository to use code scanning, check that GitHub Advanced Security is enabled. For more information, see "Managing security and analysis settings for your repository."
so yes, you would need GitHub Advanced Security to be enabled for your private repository for this to work.
GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. Other security features require GitHub Advanced Security to run on repositories apart from public repositories on GitHub.com.
To purchase a GitHub Advanced Security license, you must be using GitHub Enterprise. For information about upgrading to GitHub Enterprise with GitHub Advanced Security, see "GitHub's products" and "About billing for GitHub Advanced Security."
Activity
RasmusWL commentedon Feb 21, 2022
From https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
so yes, you would need GitHub Advanced Security to be enabled for your private repository for this to work.
selfagency commentedon Feb 21, 2022
I switched to Enterprise and Advanced Security...doesn't come with it? LMAO.
RasmusWL commentedon Feb 21, 2022
Correct.
from: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
RasmusWL commentedon Feb 21, 2022
Seems to me like your question has been solved, so I'm closing this issue.