GitHub Actions SARIF

GitHub Actions security scanner with SARIF output.

Run the same local SAST rules in GitHub Actions, upload SARIF to GitHub code scanning, annotate pull requests, and enforce a merge threshold.

Add the workflow SARIF reports Block risky pull requests

Direct answer

GitHub Actions security scanner with SARIF output

Run the same local SAST rules in GitHub Actions, upload SARIF to GitHub code scanning, annotate pull requests, and enforce a merge threshold.

Add the workflow SARIF reports

What does the Code Radar GitHub Actions gate do?

It runs Radar in the GitHub Actions runner, produces SARIF-ready evidence, and can fail a pull request when findings meet the configured severity threshold.

Does the CI workflow upload source code to Code Radar?

No. The scan runs in the runner environment. The paid workflow validates entitlement and repository slots, while source files and generated reports remain where the command runs.

When is a repository slot worth paying for?

A repository slot is worth paying for when local findings are trusted enough to become shared reviewer evidence and a merge gate for a real repository.

Which proof should be reviewed before rollout?

Review the local scan result, SARIF output, fail-on threshold, and sample report before making the GitHub Actions gate block merges.

Intentanswer github actions security scanner, PR security gate, upload SARIF, and fail PR on vulnerabilities searches

ProofGitHub Actions workflow YAML, local finding quality, SARIF upload, HTML artifact, fail-on threshold, and repository-slot validation

Next actionrun Radar locally first, add the workflow in advisory mode, then buy repository slots when the gate should block merges

Decision evidence

Proof path before a PR gate blocks merges.

CI intent converts when the buyer sees how local findings become SARIF evidence, what fails the pull request, and which source boundary is preserved in the runner.

github actions security scanner

Code Radar runs inside GitHub Actions and can turn trusted local findings into pull-request evidence.

Evidence to inspect: Workflow YAML, runner-local scan, SARIF upload, HTML artifact, and code-scanning annotations.
Boundary: The runner reads the code; Radar entitlement checks validate repository slots without uploading source.

Read setup docs

fail pr on vulnerabilities

The gate should block only when severity thresholds are explicit and trusted by reviewers.

Evidence to inspect: `--fail-on` policy, local preflight scan, finding severity, report output, and reviewer-visible annotation.
Boundary: Start advisory before blocking merges if the team has not tuned noise and severity policy.

Inspect sample report

github code scanning sarif

SARIF output lets Radar evidence appear in GitHub code scanning without changing the local scanner workflow.

Evidence to inspect: SARIF export, upload step, alert location, rule id, severity, and remediation guidance.
Boundary: SARIF is useful only when the underlying finding quality is specific enough to fix.

Review report formats

CI conversion path

Turn search traffic into a paid pull-request gate.

GitHub Actions visitors usually already know the workflow they want. The page should move them from query to SARIF evidence, repository slot value, and a concrete setup step.

I need a GitHub Actions scannerWorkflow setupAdd the workflow and fail-on thresholdFastest path from organic intent to implementation.Proof: workflow YAML, SARIF upload, and merge thresholdgithub actions security scannerci security scannerpull request security scanner I need SARIF in GitHubSARIF reportsVerify the report shapeBest when the buyer needs proof before gating PRs.Proof: SARIF, JSON, HTML, and terminal report shapegithub code scanning sarifupload sarif github actionsthird party code scanning tool github I need CI pricingPricingChoose Pro or Studio repository slotsBest when the visitor is ready to pay for shared enforcement.Proof: plan boundary, paid workflow trigger, and checkout readinessrepository security gatepaid ci scannerdeveloper security ci

CI conversion path

Turn every pull request into an enforceable security gate.

Radar in GitHub Actions gives teams a paid, repository-scoped enforcement point: fail high-risk PRs, upload SARIF, and keep review evidence inside the existing GitHub workflow.

Add the workflow See CI plans

GateFail on highBlock risky pull requests before reviewers inherit the problem.

ReportSARIF uploadSurface third-party findings in GitHub code scanning.

LicenseRepo slotsCI usage maps to paid repository entitlements.

RolloutOne workflowStart with advisory mode, then make the gate required.

radar scan . --format sarif --fail-on high
radar github upload-sarif radar.sarif

This page should convert searches for GitHub Actions security scanner, PR security gate, pull request security scanner, and CI security scanner.

CI sales path

Turn useful local findings into a paid pull-request gate.

GitHub Actions is where Radar becomes a shared team control: the same finding shape moves from local review into SARIF, annotations, and an explicit fail-on threshold.

Add workflow See CI plans

Good fit

Use when reviewers need a visible pass/fail signal before merge.
Use when SARIF should appear in GitHub code scanning from a third-party scanner.
Use when repository slots and CI validation justify a paid plan.

Risk reversal

Do not start with an aggressive threshold before the team trusts the rules.
Do not let SARIF become another ignored alert stream.
Do not add CI until the local workflow already produces useful findings.

Fail-on thresholdSARIF uploadRepository slotsReviewer evidence

Product evidence

Preview the CI gate before adding it.

See the failing check, finding detail, SARIF-ready signal, and agent handoff before rollout.

View sample report Local scan docs

radar scan . --quick

Illustrative sample output

Live scan

License validation0.18s

Discover files412 files

Security rulesdone

Dependency auditdone

ReportsSARIF/JSON

CRITICAL

SQL injection risksrc/api/payments.ts:42

HIGH

Hardcoded secret.env.example:12

MEDIUM

Vulnerable dependencyCargo.lock

Selected finding

MessageWhyFixExport

Untrusted input reaches raw SQL construction.

Request data is interpolated into a query string before execution. This can expose customer data or mutate records.

How to fixValidate input and use parameterized queries before execution.

Example structure, not a customer result. Run the same check on your repository for real evidence.

Paid CI trigger

Buy the repository gate only after CI evidence earns trust.

GitHub Actions traffic is high intent, but the paid step should still be explicit: prove the local signal, run advisory, tune fail-on, then spend repository slots when the gate becomes team policy.

Start advisory before blocking.

Run Radar in GitHub Actions without a hard failure first, so reviewers can compare CI findings against local scan output.

Do not make the check required until the team agrees which severities should block a pull request.

github actions security scannerci security scannerpull request security scanner

Add advisory workflow

Promote trusted findings to fail-on.

Use an explicit fail-on threshold when high-confidence findings should stop merge instead of becoming review comments.

Do not fail every finding category at rollout; start with the severities reviewers already trust.

fail pr on vulnerabilitiespr security gatefail pull request security

Tune threshold

Use SARIF when GitHub is the evidence home.

Upload SARIF when third-party findings need to appear in GitHub code scanning and stay visible to reviewers.

Do not create a separate alert stream if reviewers only act inside pull requests.

github code scanning sarifupload sarif github actionsthird party code scanning tool github

Review SARIF output

Buy repository slots when the gate becomes policy.

A paid repository slot is justified when the same workflow must validate every pull request for a team repository.

Do not buy CI capacity before the local scan and advisory run have proven useful signal.

repository security gatepaid ci scannerdeveloper security ci

See CI plans

Deterministic PR gates

Use severity thresholds and policy files to turn security scan output into a clear pass/fail signal for pull requests, fail PRs on vulnerabilities, and upload SARIF in GitHub Actions.

PR security gate
Pull request security scanner
CI security scanner
Fail-on thresholds

Minimal workflow

Add the action and pass the license key through repository secrets.

uses: T-and-T-soft/code-radar@v1
with:
  license-key: ${{ secrets.RADAR_LICENSE_KEY }}
  fail-on: high

GitHub Actions scanner FAQ

Confirm the runner boundary, SARIF evidence, severity threshold, and repository entitlement before the workflow blocks merges.