Skip to content

Are SARIF uploads from private repos only available to enterprise users? #943

Closed

Description

@selfagency

I'm using an open source SAST scanner that generates SARIF files and as far as I understood, I would be able to upload the SARIF files using github/codeql-action/upload-sarif without having to be an enterprise user/paying for CodeQL since I'm not using the service. Was I mistaken? Can I not upload the reports to and view them under the Security tab? I'm getting an error in my workflow saying HttpError: Resource not accessible by integration. If it's the case that it's not available for private repos except for enterprise users, that is deeply unfortunate.

Activity

  1. RasmusWL commented on Feb 21, 2022

    @RasmusWL
    Member

    From https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github

    Note: For private and internal repositories, code scanning is available when GitHub Advanced Security features are enabled for the repository. If you see the error Advanced Security must be enabled for this repository to use code scanning, check that GitHub Advanced Security is enabled. For more information, see "Managing security and analysis settings for your repository."

    so yes, you would need GitHub Advanced Security to be enabled for your private repository for this to work.

  2. selfagency commented on Feb 21, 2022

    @selfagency
    Author

    I switched to Enterprise and Advanced Security...doesn't come with it? LMAO.

  3. RasmusWL commented on Feb 21, 2022

    @RasmusWL
    Member

    Correct.

    from: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security

    GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. Other security features require GitHub Advanced Security to run on repositories apart from public repositories on GitHub.com.

    To purchase a GitHub Advanced Security license, you must be using GitHub Enterprise. For information about upgrading to GitHub Enterprise with GitHub Advanced Security, see "GitHub's products" and "About billing for GitHub Advanced Security."

  4. RasmusWL commented on Feb 21, 2022

    @RasmusWL
    Member

    Seems to me like your question has been solved, so I'm closing this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions