[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-microsoft-publish-to-ghas":3,"mdc--d869rf-key":37,"related-repo-microsoft-publish-to-ghas":1410,"related-org-microsoft-publish-to-ghas":1420},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"publish-to-ghas","publish SARIF files to GitHub Advanced Security","Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"microsoft","Microsoft","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fmicrosoft.png",[12,16,19,20,23],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"GitHub","github",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":15},"Code Analysis","code-analysis",224,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsarif-sdk","2026-07-03T16:31:31.41083",null,105,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],".NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https:\u002F\u002Fgithub.com\u002Foasis-tcs\u002Fsarif-spec)","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsarif-sdk\u002Ftree\u002FHEAD\u002Fskills\u002Fpublish-to-ghas","---\nname: publish-to-ghas\ndescription: Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.\nmetadata:\n  author: sarif-sdk-maintainers\n  version: \"2.0.0\"\n  category: sarif\n  severity: medium\n  packages:\n    - \"Sarif.Multitool >= 5.1.0\"\n  triggers:\n    - \"publish sarif\"\n    - \"upload sarif\"\n    - \"ghas\"\n    - \"github advanced security\"\n    - \"code scanning\"\n    - \"sarif ingestion\"\n---\n\n# Publish SARIF to GHAS (GitHub code scanning)\n\n## Context\n\nGitHub Advanced Security (GHAS) ingests SARIF through the GitHub code-scanning SARIF API\n([`POST \u002Frepos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Fsarifs`](https:\u002F\u002Fdocs.github.com\u002Fen\u002Frest\u002Fcode-scanning\u002Fcode-scanning#upload-an-analysis-as-sarif-data)).\nThe [`publish-to-ghas`](..\u002F..\u002Fsrc\u002FSarif.Multitool.Library\u002FPublishToGhas\u002FPublishToGhasCommand.cs) verb\nuploads a finalized SARIF file to that endpoint: it derives the GitHub `owner\u002Frepo`, the `commit_sha`,\nand the `ref` from the run's version-control provenance, gzip-compresses and base64-encodes the body\ninto the JSON payload, and posts it under a caller-supplied bearer token. The verb is the companion of\n[`publish-to-ghazdo`](..\u002Fpublish-to-ghazdo\u002FSKILL.md) for Azure DevOps targets, and shares its\nlog-level refusal of an unpublishable (`--no-repo`) log.\n\nPublish a SARIF only after it is **finalized** — its first run must carry a GitHub `repositoryUri`,\n`revisionId`, and branch under `versionControlProvenance` (see [`emit-sarif`](..\u002Femit-sarif\u002FSKILL.md)\nand the `emit-finalize` verb). The target `owner\u002Frepo`, the `commit_sha`, and the `ref` are read from\nthat provenance, so an unfinalized file cannot be published.\n\n### Why finalize matters for GHAS specifically\n\n`emit-finalize` stamps the metadata GHAS needs to treat a finding as a *security* alert:\n\n- **`security-severity`** on each AI rule (curated per-CWE prior, or a neutral medium default for\n  uncurated content). GitHub buckets the alert critical\u002Fhigh\u002Fmedium\u002Flow from this value.\n- **`tags`** on each AI rule — `[\"security\", \"external\u002Fcwe\u002Fcwe-\u003Cn>\"]` for a CWE rule, `[\"security\"]`\n  for a `NOVEL-` rule. **GitHub ignores `security-severity` unless the `security` tag is present**,\n  so an unfinalized file uploads as plain code-scanning results with no security severity.\n\nThese tags are emitted only for GitHub-hosted runs; an Azure DevOps-hosted SARIF will not carry them\n(publish that one with [`publish-to-ghazdo`](..\u002Fpublish-to-ghazdo\u002FSKILL.md) instead).\n\n## Security model\n\nThis is the security-critical part of the skill. Follow it exactly.\n\n- **The token never appears on the command line.** Place the token in an environment variable and name\n  that variable with `--token-env-var` (default `GHAS_TOKEN`, paralleling `publish-to-ghazdo`'s\n  `GHAZDO_TOKEN`). The verb reads the value from the\n  environment; it is never an argument, and it is never printed — not in dry-run output, not in error\n  messages, and it is redacted from any server response body or exception text.\n- **Always sent as `Authorization: Bearer`.** A classic or fine-grained GitHub personal access token\n  carrying **`security_events`** write (`repo` also grants it for private repositories) is sent as a\n  bearer token. Less scope yields HTTP 403.\n- **GitHub hosts only.** The target must resolve to `github.com` or a `\u003Cslug>.ghe.com` data-residency\n  host from `versionControlProvenance`; the API host is `api.github.com` or `api.\u003Cslug>.ghe.com`\n  respectively. A `dev.azure.com` (GHAzDO) target, a legacy host, and credential-bearing repository\n  URLs are rejected. A GitHub SSH\u002Fscp clone URL is normalized to its https identity.\n\n## Prerequisites\n\n- **`Sarif.Multitool` ≥ 5.1.0.** Recommended invocation: `dotnet dnx Sarif.Multitool --yes -- publish-to-ghas ...`\n  (zero-install, requires .NET 10+). Fall back to `dotnet tool install --global Sarif.Multitool`,\n  then invoke as `sarif publish-to-ghas ...`.\n- A **finalized** SARIF whose first run carries a GitHub `repositoryUri`, `revisionId`, and a\n  `refs\u002Fheads\u002F...` branch.\n- A GitHub personal access token with `security_events` write, stored in an environment variable.\n\n## Detection\n\n### Inputs\n\n| Parameter | Required | Description |\n|---|---|---|\n| `{{SARIF_FILE}}` | Yes | Path to the finalized `.sarif` file to upload |\n| `{{TOKEN_ENV_VAR}}` | No | Name of the environment variable holding the token. Default `GHAS_TOKEN` |\n\n### Step 1 — Set the token in the environment\n\nSet the variable in the current session only. Do not write the token to a file, a script, or shell\nhistory. Use your platform's mechanism for assigning a value without echoing it.\n\n```powershell\n# PowerShell — paste the token when prompted; it is not echoed to history.\n$env:GHAS_TOKEN = (Read-Host -AsSecureString | ForEach-Object { [System.Net.NetworkCredential]::new('', $_).Password })\n```\n\n```bash\n# bash — read without echo.\nread -rs GHAS_TOKEN && export GHAS_TOKEN\n```\n\n### Step 2 — Validate pre-flight (no network)\n\nGHAS ingestion-blocking defects are detectable offline. A clean validation under the GHAS rule\nkinds is the offline equivalent of upload acceptance — run it before the round-trip.\n\n```powershell\ndotnet dnx Sarif.Multitool --yes -- validate \"{{SARIF_FILE}}\" --rule-kind \"Sarif;AI;Ghas\"\n```\n\nResolve any **error**-level findings before publishing. In particular, GHAS will not surface a\nsecurity severity unless each AI rule carries the `security` tag — re-finalize (`emit-finalize`) the\nSARIF rather than hand-editing tags.\n\n### Step 3 — Dry run (no network)\n\nAlways dry-run first. This resolves the GitHub target, the `ref`, and the `commit_sha` from the\nSARIF's provenance and prints the request shape **without contacting the server and without printing\nthe token**.\n\n```powershell\ndotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\" --dry-run\n```\n\nConfirm the reported `owner\u002Frepo`, `ref`, and `commit_sha`. If the target is wrong, the SARIF was not\nfinalized against the intended GitHub repository — re-finalize it; do not hand-edit these values.\n\n### Step 4 — Publish\n\n```powershell\ndotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\"\n```\n\nTo name a different environment variable:\n\n```powershell\ndotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\" --token-env-var \"{{TOKEN_ENV_VAR}}\"\n```\n\nThe verb posts to `api.github.com` (or `api.\u003Cslug>.ghe.com`). Exit code `0` means the server accepted\nthe upload (HTTP 2xx — GitHub answers `202 Accepted`); a non-zero exit code with `error: publish\nfailed with HTTP \u003Ccode>` means it did not. The verb prints the analysis response body (with the token\nredacted) — its `url` is the analysis status endpoint, which you can poll with `gh api` until\n`\"processing_status\": \"complete\"`.\n\n**If `dotnet dnx` is not available:** install the global tool and use the `sarif` command name:\n\n```powershell\ndotnet tool install --global Sarif.Multitool\nsarif publish-to-ghas \"{{SARIF_FILE}}\"\n```\n\n## Edge Cases\n\n1. **No provenance** — The run carries no `versionControlProvenance[0].repositoryUri`. The verb fails\n   closed. Finalize the SARIF (`emit-finalize`) before publishing.\n2. **Unpublishable (repo-less) log** — Any run carries `properties.unpublishable = true`, stamped by\n   `emit-finalize --no-repo` for a scan outside version control. The verb refuses the whole file up\n   front (publishing ingests every run): a non-version-controlled scan has no repository or commit to\n   anchor alerts to. Publish a log whose runs were all finalized against a checked-out repository\n   (without `--no-repo`); split a merged log first if only some runs are unpublishable.\n3. **Non-GitHub target** — The repository is `dev.azure.com` or a legacy host. The verb rejects it;\n   use `publish-to-ghazdo`.\n4. **Missing `revisionId` or `branch`** — GHAS anchors an analysis to a commit and a fully-qualified\n   ref (`refs\u002Fheads\u002F...`). The verb fails closed if either is absent; re-finalize with both present.\n5. **`commit_sha` not in the repo** — GitHub rejects an analysis whose commit it cannot find. Publish\n   against a SARIF finalized at a commit that has been pushed.\n6. **HTTP 403** — The token lacks `security_events` (or `repo` for a private repo), or GHAS \u002F code\n   scanning is not enabled on the repository.\n7. **HTTP 404** — `owner\u002Frepo` does not resolve, or the token cannot see it.\n8. **No security severity on alerts** — The alerts appear but without critical\u002Fhigh\u002Fmedium\u002Flow. The\n   rules are missing the `security` tag; re-finalize so `emit-finalize` stamps it (Step 2 catches\n   this offline).\n\n## Validation\n\nAfter running this skill:\n\n1. The token never appeared in any printed command, log line, or error message.\n2. The GHAS-ruleset validation (`--rule-kind \"Sarif;AI;Ghas\"`) was clean before the live publish.\n3. The dry-run `owner\u002Frepo` + `ref` + `commit_sha` matched the intended GitHub repository.\n4. A successful publish returned exit code `0` and the analysis reached `processing_status: complete`.\n5. The resulting alerts carry a security severity (critical\u002Fhigh\u002Fmedium\u002Flow) — confirming the\n   `security` tag and `security-severity` survived finalize.\n\n## Escalation\n\n- **Multitool not available** — Neither `dotnet dnx` nor a global install succeeded. Report the gap;\n  the SARIF cannot be published from this environment.\n- **Repeated 4xx \u002F non-`complete` status** — After confirming target, ref, commit, and token scope,\n  capture the analysis `errors` body the verb prints (it contains no secret) and escalate to the\n  repository's Advanced Security administrator.\n",{"data":38,"body":53},{"name":4,"description":6,"metadata":39},{"author":40,"version":41,"category":42,"severity":43,"packages":44,"triggers":46},"sarif-sdk-maintainers","2.0.0","sarif","medium",[45],"Sarif.Multitool >= 5.1.0",[47,48,49,50,51,52],"publish sarif","upload sarif","ghas","github advanced security","code scanning","sarif ingestion",{"type":54,"children":55},"root",[56,65,72,149,226,233,250,328,343,349,354,492,498,585,591,597,687,693,698,729,785,791,796,810,836,842,866,880,905,911,925,930,944,1010,1035,1058,1064,1257,1263,1268,1352,1358,1404],{"type":57,"tag":58,"props":59,"children":61},"element","h1",{"id":60},"publish-sarif-to-ghas-github-code-scanning",[62],{"type":63,"value":64},"text","Publish SARIF to GHAS (GitHub code scanning)",{"type":57,"tag":66,"props":67,"children":69},"h2",{"id":68},"context",[70],{"type":63,"value":71},"Context",{"type":57,"tag":73,"props":74,"children":75},"p",{},[76,78,92,94,103,105,111,113,119,121,127,129,139,141,147],{"type":63,"value":77},"GitHub Advanced Security (GHAS) ingests SARIF through the GitHub code-scanning SARIF API\n(",{"type":57,"tag":79,"props":80,"children":84},"a",{"href":81,"rel":82},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Frest\u002Fcode-scanning\u002Fcode-scanning#upload-an-analysis-as-sarif-data",[83],"nofollow",[85],{"type":57,"tag":86,"props":87,"children":89},"code",{"className":88},[],[90],{"type":63,"value":91},"POST \u002Frepos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Fsarifs",{"type":63,"value":93},").\nThe ",{"type":57,"tag":79,"props":95,"children":97},{"href":96},"..\u002F..\u002Fsrc\u002FSarif.Multitool.Library\u002FPublishToGhas\u002FPublishToGhasCommand.cs",[98],{"type":57,"tag":86,"props":99,"children":101},{"className":100},[],[102],{"type":63,"value":4},{"type":63,"value":104}," verb\nuploads a finalized SARIF file to that endpoint: it derives the GitHub ",{"type":57,"tag":86,"props":106,"children":108},{"className":107},[],[109],{"type":63,"value":110},"owner\u002Frepo",{"type":63,"value":112},", the ",{"type":57,"tag":86,"props":114,"children":116},{"className":115},[],[117],{"type":63,"value":118},"commit_sha",{"type":63,"value":120},",\nand the ",{"type":57,"tag":86,"props":122,"children":124},{"className":123},[],[125],{"type":63,"value":126},"ref",{"type":63,"value":128}," from the run's version-control provenance, gzip-compresses and base64-encodes the body\ninto the JSON payload, and posts it under a caller-supplied bearer token. The verb is the companion of\n",{"type":57,"tag":79,"props":130,"children":132},{"href":131},"..\u002Fpublish-to-ghazdo\u002FSKILL.md",[133],{"type":57,"tag":86,"props":134,"children":136},{"className":135},[],[137],{"type":63,"value":138},"publish-to-ghazdo",{"type":63,"value":140}," for Azure DevOps targets, and shares its\nlog-level refusal of an unpublishable (",{"type":57,"tag":86,"props":142,"children":144},{"className":143},[],[145],{"type":63,"value":146},"--no-repo",{"type":63,"value":148},") log.",{"type":57,"tag":73,"props":150,"children":151},{},[152,154,160,162,168,170,176,178,184,186,196,198,204,206,211,212,217,219,224],{"type":63,"value":153},"Publish a SARIF only after it is ",{"type":57,"tag":155,"props":156,"children":157},"strong",{},[158],{"type":63,"value":159},"finalized",{"type":63,"value":161}," — its first run must carry a GitHub ",{"type":57,"tag":86,"props":163,"children":165},{"className":164},[],[166],{"type":63,"value":167},"repositoryUri",{"type":63,"value":169},",\n",{"type":57,"tag":86,"props":171,"children":173},{"className":172},[],[174],{"type":63,"value":175},"revisionId",{"type":63,"value":177},", and branch under ",{"type":57,"tag":86,"props":179,"children":181},{"className":180},[],[182],{"type":63,"value":183},"versionControlProvenance",{"type":63,"value":185}," (see ",{"type":57,"tag":79,"props":187,"children":189},{"href":188},"..\u002Femit-sarif\u002FSKILL.md",[190],{"type":57,"tag":86,"props":191,"children":193},{"className":192},[],[194],{"type":63,"value":195},"emit-sarif",{"type":63,"value":197},"\nand the ",{"type":57,"tag":86,"props":199,"children":201},{"className":200},[],[202],{"type":63,"value":203},"emit-finalize",{"type":63,"value":205}," verb). The target ",{"type":57,"tag":86,"props":207,"children":209},{"className":208},[],[210],{"type":63,"value":110},{"type":63,"value":112},{"type":57,"tag":86,"props":213,"children":215},{"className":214},[],[216],{"type":63,"value":118},{"type":63,"value":218},", and the ",{"type":57,"tag":86,"props":220,"children":222},{"className":221},[],[223],{"type":63,"value":126},{"type":63,"value":225}," are read from\nthat provenance, so an unfinalized file cannot be published.",{"type":57,"tag":227,"props":228,"children":230},"h3",{"id":229},"why-finalize-matters-for-ghas-specifically",[231],{"type":63,"value":232},"Why finalize matters for GHAS specifically",{"type":57,"tag":73,"props":234,"children":235},{},[236,241,243,248],{"type":57,"tag":86,"props":237,"children":239},{"className":238},[],[240],{"type":63,"value":203},{"type":63,"value":242}," stamps the metadata GHAS needs to treat a finding as a ",{"type":57,"tag":244,"props":245,"children":246},"em",{},[247],{"type":63,"value":14},{"type":63,"value":249}," alert:",{"type":57,"tag":251,"props":252,"children":253},"ul",{},[254,269],{"type":57,"tag":255,"props":256,"children":257},"li",{},[258,267],{"type":57,"tag":155,"props":259,"children":260},{},[261],{"type":57,"tag":86,"props":262,"children":264},{"className":263},[],[265],{"type":63,"value":266},"security-severity",{"type":63,"value":268}," on each AI rule (curated per-CWE prior, or a neutral medium default for\nuncurated content). GitHub buckets the alert critical\u002Fhigh\u002Fmedium\u002Flow from this value.",{"type":57,"tag":255,"props":270,"children":271},{},[272,281,283,289,291,297,299,305,307,326],{"type":57,"tag":155,"props":273,"children":274},{},[275],{"type":57,"tag":86,"props":276,"children":278},{"className":277},[],[279],{"type":63,"value":280},"tags",{"type":63,"value":282}," on each AI rule — ",{"type":57,"tag":86,"props":284,"children":286},{"className":285},[],[287],{"type":63,"value":288},"[\"security\", \"external\u002Fcwe\u002Fcwe-\u003Cn>\"]",{"type":63,"value":290}," for a CWE rule, ",{"type":57,"tag":86,"props":292,"children":294},{"className":293},[],[295],{"type":63,"value":296},"[\"security\"]",{"type":63,"value":298},"\nfor a ",{"type":57,"tag":86,"props":300,"children":302},{"className":301},[],[303],{"type":63,"value":304},"NOVEL-",{"type":63,"value":306}," rule. ",{"type":57,"tag":155,"props":308,"children":309},{},[310,312,317,319,324],{"type":63,"value":311},"GitHub ignores ",{"type":57,"tag":86,"props":313,"children":315},{"className":314},[],[316],{"type":63,"value":266},{"type":63,"value":318}," unless the ",{"type":57,"tag":86,"props":320,"children":322},{"className":321},[],[323],{"type":63,"value":14},{"type":63,"value":325}," tag is present",{"type":63,"value":327},",\nso an unfinalized file uploads as plain code-scanning results with no security severity.",{"type":57,"tag":73,"props":329,"children":330},{},[331,333,341],{"type":63,"value":332},"These tags are emitted only for GitHub-hosted runs; an Azure DevOps-hosted SARIF will not carry them\n(publish that one with ",{"type":57,"tag":79,"props":334,"children":335},{"href":131},[336],{"type":57,"tag":86,"props":337,"children":339},{"className":338},[],[340],{"type":63,"value":138},{"type":63,"value":342}," instead).",{"type":57,"tag":66,"props":344,"children":346},{"id":345},"security-model",[347],{"type":63,"value":348},"Security model",{"type":57,"tag":73,"props":350,"children":351},{},[352],{"type":63,"value":353},"This is the security-critical part of the skill. Follow it exactly.",{"type":57,"tag":251,"props":355,"children":356},{},[357,398,435],{"type":57,"tag":255,"props":358,"children":359},{},[360,365,367,373,375,381,383,388,390,396],{"type":57,"tag":155,"props":361,"children":362},{},[363],{"type":63,"value":364},"The token never appears on the command line.",{"type":63,"value":366}," Place the token in an environment variable and name\nthat variable with ",{"type":57,"tag":86,"props":368,"children":370},{"className":369},[],[371],{"type":63,"value":372},"--token-env-var",{"type":63,"value":374}," (default ",{"type":57,"tag":86,"props":376,"children":378},{"className":377},[],[379],{"type":63,"value":380},"GHAS_TOKEN",{"type":63,"value":382},", paralleling ",{"type":57,"tag":86,"props":384,"children":386},{"className":385},[],[387],{"type":63,"value":138},{"type":63,"value":389},"'s\n",{"type":57,"tag":86,"props":391,"children":393},{"className":392},[],[394],{"type":63,"value":395},"GHAZDO_TOKEN",{"type":63,"value":397},"). The verb reads the value from the\nenvironment; it is never an argument, and it is never printed — not in dry-run output, not in error\nmessages, and it is redacted from any server response body or exception text.",{"type":57,"tag":255,"props":399,"children":400},{},[401,414,416,425,427,433],{"type":57,"tag":155,"props":402,"children":403},{},[404,406,412],{"type":63,"value":405},"Always sent as ",{"type":57,"tag":86,"props":407,"children":409},{"className":408},[],[410],{"type":63,"value":411},"Authorization: Bearer",{"type":63,"value":413},".",{"type":63,"value":415}," A classic or fine-grained GitHub personal access token\ncarrying ",{"type":57,"tag":155,"props":417,"children":418},{},[419],{"type":57,"tag":86,"props":420,"children":422},{"className":421},[],[423],{"type":63,"value":424},"security_events",{"type":63,"value":426}," write (",{"type":57,"tag":86,"props":428,"children":430},{"className":429},[],[431],{"type":63,"value":432},"repo",{"type":63,"value":434}," also grants it for private repositories) is sent as a\nbearer token. Less scope yields HTTP 403.",{"type":57,"tag":255,"props":436,"children":437},{},[438,443,445,451,453,459,461,466,468,474,476,482,484,490],{"type":57,"tag":155,"props":439,"children":440},{},[441],{"type":63,"value":442},"GitHub hosts only.",{"type":63,"value":444}," The target must resolve to ",{"type":57,"tag":86,"props":446,"children":448},{"className":447},[],[449],{"type":63,"value":450},"github.com",{"type":63,"value":452}," or a ",{"type":57,"tag":86,"props":454,"children":456},{"className":455},[],[457],{"type":63,"value":458},"\u003Cslug>.ghe.com",{"type":63,"value":460}," data-residency\nhost from ",{"type":57,"tag":86,"props":462,"children":464},{"className":463},[],[465],{"type":63,"value":183},{"type":63,"value":467},"; the API host is ",{"type":57,"tag":86,"props":469,"children":471},{"className":470},[],[472],{"type":63,"value":473},"api.github.com",{"type":63,"value":475}," or ",{"type":57,"tag":86,"props":477,"children":479},{"className":478},[],[480],{"type":63,"value":481},"api.\u003Cslug>.ghe.com",{"type":63,"value":483},"\nrespectively. A ",{"type":57,"tag":86,"props":485,"children":487},{"className":486},[],[488],{"type":63,"value":489},"dev.azure.com",{"type":63,"value":491}," (GHAzDO) target, a legacy host, and credential-bearing repository\nURLs are rejected. A GitHub SSH\u002Fscp clone URL is normalized to its https identity.",{"type":57,"tag":66,"props":493,"children":495},{"id":494},"prerequisites",[496],{"type":63,"value":497},"Prerequisites",{"type":57,"tag":251,"props":499,"children":500},{},[501,540,573],{"type":57,"tag":255,"props":502,"children":503},{},[504,515,517,523,525,531,533,539],{"type":57,"tag":155,"props":505,"children":506},{},[507,513],{"type":57,"tag":86,"props":508,"children":510},{"className":509},[],[511],{"type":63,"value":512},"Sarif.Multitool",{"type":63,"value":514}," ≥ 5.1.0.",{"type":63,"value":516}," Recommended invocation: ",{"type":57,"tag":86,"props":518,"children":520},{"className":519},[],[521],{"type":63,"value":522},"dotnet dnx Sarif.Multitool --yes -- publish-to-ghas ...",{"type":63,"value":524},"\n(zero-install, requires .NET 10+). Fall back to ",{"type":57,"tag":86,"props":526,"children":528},{"className":527},[],[529],{"type":63,"value":530},"dotnet tool install --global Sarif.Multitool",{"type":63,"value":532},",\nthen invoke as ",{"type":57,"tag":86,"props":534,"children":536},{"className":535},[],[537],{"type":63,"value":538},"sarif publish-to-ghas ...",{"type":63,"value":413},{"type":57,"tag":255,"props":541,"children":542},{},[543,545,549,551,556,558,563,565,571],{"type":63,"value":544},"A ",{"type":57,"tag":155,"props":546,"children":547},{},[548],{"type":63,"value":159},{"type":63,"value":550}," SARIF whose first run carries a GitHub ",{"type":57,"tag":86,"props":552,"children":554},{"className":553},[],[555],{"type":63,"value":167},{"type":63,"value":557},", ",{"type":57,"tag":86,"props":559,"children":561},{"className":560},[],[562],{"type":63,"value":175},{"type":63,"value":564},", and a\n",{"type":57,"tag":86,"props":566,"children":568},{"className":567},[],[569],{"type":63,"value":570},"refs\u002Fheads\u002F...",{"type":63,"value":572}," branch.",{"type":57,"tag":255,"props":574,"children":575},{},[576,578,583],{"type":63,"value":577},"A GitHub personal access token with ",{"type":57,"tag":86,"props":579,"children":581},{"className":580},[],[582],{"type":63,"value":424},{"type":63,"value":584}," write, stored in an environment variable.",{"type":57,"tag":66,"props":586,"children":588},{"id":587},"detection",[589],{"type":63,"value":590},"Detection",{"type":57,"tag":227,"props":592,"children":594},{"id":593},"inputs",[595],{"type":63,"value":596},"Inputs",{"type":57,"tag":598,"props":599,"children":600},"table",{},[601,625],{"type":57,"tag":602,"props":603,"children":604},"thead",{},[605],{"type":57,"tag":606,"props":607,"children":608},"tr",{},[609,615,620],{"type":57,"tag":610,"props":611,"children":612},"th",{},[613],{"type":63,"value":614},"Parameter",{"type":57,"tag":610,"props":616,"children":617},{},[618],{"type":63,"value":619},"Required",{"type":57,"tag":610,"props":621,"children":622},{},[623],{"type":63,"value":624},"Description",{"type":57,"tag":626,"props":627,"children":628},"tbody",{},[629,660],{"type":57,"tag":606,"props":630,"children":631},{},[632,642,647],{"type":57,"tag":633,"props":634,"children":635},"td",{},[636],{"type":57,"tag":86,"props":637,"children":639},{"className":638},[],[640],{"type":63,"value":641},"{{SARIF_FILE}}",{"type":57,"tag":633,"props":643,"children":644},{},[645],{"type":63,"value":646},"Yes",{"type":57,"tag":633,"props":648,"children":649},{},[650,652,658],{"type":63,"value":651},"Path to the finalized ",{"type":57,"tag":86,"props":653,"children":655},{"className":654},[],[656],{"type":63,"value":657},".sarif",{"type":63,"value":659}," file to upload",{"type":57,"tag":606,"props":661,"children":662},{},[663,672,677],{"type":57,"tag":633,"props":664,"children":665},{},[666],{"type":57,"tag":86,"props":667,"children":669},{"className":668},[],[670],{"type":63,"value":671},"{{TOKEN_ENV_VAR}}",{"type":57,"tag":633,"props":673,"children":674},{},[675],{"type":63,"value":676},"No",{"type":57,"tag":633,"props":678,"children":679},{},[680,682],{"type":63,"value":681},"Name of the environment variable holding the token. Default ",{"type":57,"tag":86,"props":683,"children":685},{"className":684},[],[686],{"type":63,"value":380},{"type":57,"tag":227,"props":688,"children":690},{"id":689},"step-1-set-the-token-in-the-environment",[691],{"type":63,"value":692},"Step 1 — Set the token in the environment",{"type":57,"tag":73,"props":694,"children":695},{},[696],{"type":63,"value":697},"Set the variable in the current session only. Do not write the token to a file, a script, or shell\nhistory. Use your platform's mechanism for assigning a value without echoing it.",{"type":57,"tag":699,"props":700,"children":705},"pre",{"className":701,"code":702,"language":703,"meta":704,"style":704},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# PowerShell — paste the token when prompted; it is not echoed to history.\n$env:GHAS_TOKEN = (Read-Host -AsSecureString | ForEach-Object { [System.Net.NetworkCredential]::new('', $_).Password })\n","powershell","",[706],{"type":57,"tag":86,"props":707,"children":708},{"__ignoreMap":704},[709,720],{"type":57,"tag":710,"props":711,"children":714},"span",{"class":712,"line":713},"line",1,[715],{"type":57,"tag":710,"props":716,"children":717},{},[718],{"type":63,"value":719},"# PowerShell — paste the token when prompted; it is not echoed to history.\n",{"type":57,"tag":710,"props":721,"children":723},{"class":712,"line":722},2,[724],{"type":57,"tag":710,"props":725,"children":726},{},[727],{"type":63,"value":728},"$env:GHAS_TOKEN = (Read-Host -AsSecureString | ForEach-Object { [System.Net.NetworkCredential]::new('', $_).Password })\n",{"type":57,"tag":699,"props":730,"children":734},{"className":731,"code":732,"language":733,"meta":704,"style":704},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# bash — read without echo.\nread -rs GHAS_TOKEN && export GHAS_TOKEN\n","bash",[735],{"type":57,"tag":86,"props":736,"children":737},{"__ignoreMap":704},[738,747],{"type":57,"tag":710,"props":739,"children":740},{"class":712,"line":713},[741],{"type":57,"tag":710,"props":742,"children":744},{"style":743},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[745],{"type":63,"value":746},"# bash — read without echo.\n",{"type":57,"tag":710,"props":748,"children":749},{"class":712,"line":722},[750,756,762,767,773,779],{"type":57,"tag":710,"props":751,"children":753},{"style":752},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[754],{"type":63,"value":755},"read",{"type":57,"tag":710,"props":757,"children":759},{"style":758},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[760],{"type":63,"value":761}," -rs",{"type":57,"tag":710,"props":763,"children":764},{"style":758},[765],{"type":63,"value":766}," GHAS_TOKEN",{"type":57,"tag":710,"props":768,"children":770},{"style":769},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[771],{"type":63,"value":772}," &&",{"type":57,"tag":710,"props":774,"children":776},{"style":775},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[777],{"type":63,"value":778}," export",{"type":57,"tag":710,"props":780,"children":782},{"style":781},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[783],{"type":63,"value":784}," GHAS_TOKEN\n",{"type":57,"tag":227,"props":786,"children":788},{"id":787},"step-2-validate-pre-flight-no-network",[789],{"type":63,"value":790},"Step 2 — Validate pre-flight (no network)",{"type":57,"tag":73,"props":792,"children":793},{},[794],{"type":63,"value":795},"GHAS ingestion-blocking defects are detectable offline. A clean validation under the GHAS rule\nkinds is the offline equivalent of upload acceptance — run it before the round-trip.",{"type":57,"tag":699,"props":797,"children":799},{"className":701,"code":798,"language":703,"meta":704,"style":704},"dotnet dnx Sarif.Multitool --yes -- validate \"{{SARIF_FILE}}\" --rule-kind \"Sarif;AI;Ghas\"\n",[800],{"type":57,"tag":86,"props":801,"children":802},{"__ignoreMap":704},[803],{"type":57,"tag":710,"props":804,"children":805},{"class":712,"line":713},[806],{"type":57,"tag":710,"props":807,"children":808},{},[809],{"type":63,"value":798},{"type":57,"tag":73,"props":811,"children":812},{},[813,815,820,822,827,829,834],{"type":63,"value":814},"Resolve any ",{"type":57,"tag":155,"props":816,"children":817},{},[818],{"type":63,"value":819},"error",{"type":63,"value":821},"-level findings before publishing. In particular, GHAS will not surface a\nsecurity severity unless each AI rule carries the ",{"type":57,"tag":86,"props":823,"children":825},{"className":824},[],[826],{"type":63,"value":14},{"type":63,"value":828}," tag — re-finalize (",{"type":57,"tag":86,"props":830,"children":832},{"className":831},[],[833],{"type":63,"value":203},{"type":63,"value":835},") the\nSARIF rather than hand-editing tags.",{"type":57,"tag":227,"props":837,"children":839},{"id":838},"step-3-dry-run-no-network",[840],{"type":63,"value":841},"Step 3 — Dry run (no network)",{"type":57,"tag":73,"props":843,"children":844},{},[845,847,852,853,858,860,865],{"type":63,"value":846},"Always dry-run first. This resolves the GitHub target, the ",{"type":57,"tag":86,"props":848,"children":850},{"className":849},[],[851],{"type":63,"value":126},{"type":63,"value":218},{"type":57,"tag":86,"props":854,"children":856},{"className":855},[],[857],{"type":63,"value":118},{"type":63,"value":859}," from the\nSARIF's provenance and prints the request shape ",{"type":57,"tag":155,"props":861,"children":862},{},[863],{"type":63,"value":864},"without contacting the server and without printing\nthe token",{"type":63,"value":413},{"type":57,"tag":699,"props":867,"children":869},{"className":701,"code":868,"language":703,"meta":704,"style":704},"dotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\" --dry-run\n",[870],{"type":57,"tag":86,"props":871,"children":872},{"__ignoreMap":704},[873],{"type":57,"tag":710,"props":874,"children":875},{"class":712,"line":713},[876],{"type":57,"tag":710,"props":877,"children":878},{},[879],{"type":63,"value":868},{"type":57,"tag":73,"props":881,"children":882},{},[883,885,890,891,896,898,903],{"type":63,"value":884},"Confirm the reported ",{"type":57,"tag":86,"props":886,"children":888},{"className":887},[],[889],{"type":63,"value":110},{"type":63,"value":557},{"type":57,"tag":86,"props":892,"children":894},{"className":893},[],[895],{"type":63,"value":126},{"type":63,"value":897},", and ",{"type":57,"tag":86,"props":899,"children":901},{"className":900},[],[902],{"type":63,"value":118},{"type":63,"value":904},". If the target is wrong, the SARIF was not\nfinalized against the intended GitHub repository — re-finalize it; do not hand-edit these values.",{"type":57,"tag":227,"props":906,"children":908},{"id":907},"step-4-publish",[909],{"type":63,"value":910},"Step 4 — Publish",{"type":57,"tag":699,"props":912,"children":914},{"className":701,"code":913,"language":703,"meta":704,"style":704},"dotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\"\n",[915],{"type":57,"tag":86,"props":916,"children":917},{"__ignoreMap":704},[918],{"type":57,"tag":710,"props":919,"children":920},{"class":712,"line":713},[921],{"type":57,"tag":710,"props":922,"children":923},{},[924],{"type":63,"value":913},{"type":57,"tag":73,"props":926,"children":927},{},[928],{"type":63,"value":929},"To name a different environment variable:",{"type":57,"tag":699,"props":931,"children":933},{"className":701,"code":932,"language":703,"meta":704,"style":704},"dotnet dnx Sarif.Multitool --yes -- publish-to-ghas \"{{SARIF_FILE}}\" --token-env-var \"{{TOKEN_ENV_VAR}}\"\n",[934],{"type":57,"tag":86,"props":935,"children":936},{"__ignoreMap":704},[937],{"type":57,"tag":710,"props":938,"children":939},{"class":712,"line":713},[940],{"type":57,"tag":710,"props":941,"children":942},{},[943],{"type":63,"value":932},{"type":57,"tag":73,"props":945,"children":946},{},[947,949,954,956,961,963,969,971,977,979,985,987,993,995,1001,1003,1009],{"type":63,"value":948},"The verb posts to ",{"type":57,"tag":86,"props":950,"children":952},{"className":951},[],[953],{"type":63,"value":473},{"type":63,"value":955}," (or ",{"type":57,"tag":86,"props":957,"children":959},{"className":958},[],[960],{"type":63,"value":481},{"type":63,"value":962},"). Exit code ",{"type":57,"tag":86,"props":964,"children":966},{"className":965},[],[967],{"type":63,"value":968},"0",{"type":63,"value":970}," means the server accepted\nthe upload (HTTP 2xx — GitHub answers ",{"type":57,"tag":86,"props":972,"children":974},{"className":973},[],[975],{"type":63,"value":976},"202 Accepted",{"type":63,"value":978},"); a non-zero exit code with ",{"type":57,"tag":86,"props":980,"children":982},{"className":981},[],[983],{"type":63,"value":984},"error: publish failed with HTTP \u003Ccode>",{"type":63,"value":986}," means it did not. The verb prints the analysis response body (with the token\nredacted) — its ",{"type":57,"tag":86,"props":988,"children":990},{"className":989},[],[991],{"type":63,"value":992},"url",{"type":63,"value":994}," is the analysis status endpoint, which you can poll with ",{"type":57,"tag":86,"props":996,"children":998},{"className":997},[],[999],{"type":63,"value":1000},"gh api",{"type":63,"value":1002}," until\n",{"type":57,"tag":86,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":63,"value":1008},"\"processing_status\": \"complete\"",{"type":63,"value":413},{"type":57,"tag":73,"props":1011,"children":1012},{},[1013,1026,1028,1033],{"type":57,"tag":155,"props":1014,"children":1015},{},[1016,1018,1024],{"type":63,"value":1017},"If ",{"type":57,"tag":86,"props":1019,"children":1021},{"className":1020},[],[1022],{"type":63,"value":1023},"dotnet dnx",{"type":63,"value":1025}," is not available:",{"type":63,"value":1027}," install the global tool and use the ",{"type":57,"tag":86,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":63,"value":42},{"type":63,"value":1034}," command name:",{"type":57,"tag":699,"props":1036,"children":1038},{"className":701,"code":1037,"language":703,"meta":704,"style":704},"dotnet tool install --global Sarif.Multitool\nsarif publish-to-ghas \"{{SARIF_FILE}}\"\n",[1039],{"type":57,"tag":86,"props":1040,"children":1041},{"__ignoreMap":704},[1042,1050],{"type":57,"tag":710,"props":1043,"children":1044},{"class":712,"line":713},[1045],{"type":57,"tag":710,"props":1046,"children":1047},{},[1048],{"type":63,"value":1049},"dotnet tool install --global Sarif.Multitool\n",{"type":57,"tag":710,"props":1051,"children":1052},{"class":712,"line":722},[1053],{"type":57,"tag":710,"props":1054,"children":1055},{},[1056],{"type":63,"value":1057},"sarif publish-to-ghas \"{{SARIF_FILE}}\"\n",{"type":57,"tag":66,"props":1059,"children":1061},{"id":1060},"edge-cases",[1062],{"type":63,"value":1063},"Edge Cases",{"type":57,"tag":1065,"props":1066,"children":1067},"ol",{},[1068,1093,1126,1149,1178,1193,1216,1233],{"type":57,"tag":255,"props":1069,"children":1070},{},[1071,1076,1078,1084,1086,1091],{"type":57,"tag":155,"props":1072,"children":1073},{},[1074],{"type":63,"value":1075},"No provenance",{"type":63,"value":1077}," — The run carries no ",{"type":57,"tag":86,"props":1079,"children":1081},{"className":1080},[],[1082],{"type":63,"value":1083},"versionControlProvenance[0].repositoryUri",{"type":63,"value":1085},". The verb fails\nclosed. Finalize the SARIF (",{"type":57,"tag":86,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":63,"value":203},{"type":63,"value":1092},") before publishing.",{"type":57,"tag":255,"props":1094,"children":1095},{},[1096,1101,1103,1109,1111,1117,1119,1124],{"type":57,"tag":155,"props":1097,"children":1098},{},[1099],{"type":63,"value":1100},"Unpublishable (repo-less) log",{"type":63,"value":1102}," — Any run carries ",{"type":57,"tag":86,"props":1104,"children":1106},{"className":1105},[],[1107],{"type":63,"value":1108},"properties.unpublishable = true",{"type":63,"value":1110},", stamped by\n",{"type":57,"tag":86,"props":1112,"children":1114},{"className":1113},[],[1115],{"type":63,"value":1116},"emit-finalize --no-repo",{"type":63,"value":1118}," for a scan outside version control. The verb refuses the whole file up\nfront (publishing ingests every run): a non-version-controlled scan has no repository or commit to\nanchor alerts to. Publish a log whose runs were all finalized against a checked-out repository\n(without ",{"type":57,"tag":86,"props":1120,"children":1122},{"className":1121},[],[1123],{"type":63,"value":146},{"type":63,"value":1125},"); split a merged log first if only some runs are unpublishable.",{"type":57,"tag":255,"props":1127,"children":1128},{},[1129,1134,1136,1141,1143,1148],{"type":57,"tag":155,"props":1130,"children":1131},{},[1132],{"type":63,"value":1133},"Non-GitHub target",{"type":63,"value":1135}," — The repository is ",{"type":57,"tag":86,"props":1137,"children":1139},{"className":1138},[],[1140],{"type":63,"value":489},{"type":63,"value":1142}," or a legacy host. The verb rejects it;\nuse ",{"type":57,"tag":86,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":63,"value":138},{"type":63,"value":413},{"type":57,"tag":255,"props":1150,"children":1151},{},[1152,1169,1171,1176],{"type":57,"tag":155,"props":1153,"children":1154},{},[1155,1157,1162,1163],{"type":63,"value":1156},"Missing ",{"type":57,"tag":86,"props":1158,"children":1160},{"className":1159},[],[1161],{"type":63,"value":175},{"type":63,"value":475},{"type":57,"tag":86,"props":1164,"children":1166},{"className":1165},[],[1167],{"type":63,"value":1168},"branch",{"type":63,"value":1170}," — GHAS anchors an analysis to a commit and a fully-qualified\nref (",{"type":57,"tag":86,"props":1172,"children":1174},{"className":1173},[],[1175],{"type":63,"value":570},{"type":63,"value":1177},"). The verb fails closed if either is absent; re-finalize with both present.",{"type":57,"tag":255,"props":1179,"children":1180},{},[1181,1191],{"type":57,"tag":155,"props":1182,"children":1183},{},[1184,1189],{"type":57,"tag":86,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":63,"value":118},{"type":63,"value":1190}," not in the repo",{"type":63,"value":1192}," — GitHub rejects an analysis whose commit it cannot find. Publish\nagainst a SARIF finalized at a commit that has been pushed.",{"type":57,"tag":255,"props":1194,"children":1195},{},[1196,1201,1203,1208,1209,1214],{"type":57,"tag":155,"props":1197,"children":1198},{},[1199],{"type":63,"value":1200},"HTTP 403",{"type":63,"value":1202}," — The token lacks ",{"type":57,"tag":86,"props":1204,"children":1206},{"className":1205},[],[1207],{"type":63,"value":424},{"type":63,"value":955},{"type":57,"tag":86,"props":1210,"children":1212},{"className":1211},[],[1213],{"type":63,"value":432},{"type":63,"value":1215}," for a private repo), or GHAS \u002F code\nscanning is not enabled on the repository.",{"type":57,"tag":255,"props":1217,"children":1218},{},[1219,1224,1226,1231],{"type":57,"tag":155,"props":1220,"children":1221},{},[1222],{"type":63,"value":1223},"HTTP 404",{"type":63,"value":1225}," — ",{"type":57,"tag":86,"props":1227,"children":1229},{"className":1228},[],[1230],{"type":63,"value":110},{"type":63,"value":1232}," does not resolve, or the token cannot see it.",{"type":57,"tag":255,"props":1234,"children":1235},{},[1236,1241,1243,1248,1250,1255],{"type":57,"tag":155,"props":1237,"children":1238},{},[1239],{"type":63,"value":1240},"No security severity on alerts",{"type":63,"value":1242}," — The alerts appear but without critical\u002Fhigh\u002Fmedium\u002Flow. The\nrules are missing the ",{"type":57,"tag":86,"props":1244,"children":1246},{"className":1245},[],[1247],{"type":63,"value":14},{"type":63,"value":1249}," tag; re-finalize so ",{"type":57,"tag":86,"props":1251,"children":1253},{"className":1252},[],[1254],{"type":63,"value":203},{"type":63,"value":1256}," stamps it (Step 2 catches\nthis offline).",{"type":57,"tag":66,"props":1258,"children":1260},{"id":1259},"validation",[1261],{"type":63,"value":1262},"Validation",{"type":57,"tag":73,"props":1264,"children":1265},{},[1266],{"type":63,"value":1267},"After running this skill:",{"type":57,"tag":1065,"props":1269,"children":1270},{},[1271,1276,1289,1314,1333],{"type":57,"tag":255,"props":1272,"children":1273},{},[1274],{"type":63,"value":1275},"The token never appeared in any printed command, log line, or error message.",{"type":57,"tag":255,"props":1277,"children":1278},{},[1279,1281,1287],{"type":63,"value":1280},"The GHAS-ruleset validation (",{"type":57,"tag":86,"props":1282,"children":1284},{"className":1283},[],[1285],{"type":63,"value":1286},"--rule-kind \"Sarif;AI;Ghas\"",{"type":63,"value":1288},") was clean before the live publish.",{"type":57,"tag":255,"props":1290,"children":1291},{},[1292,1294,1299,1301,1306,1307,1312],{"type":63,"value":1293},"The dry-run ",{"type":57,"tag":86,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":63,"value":110},{"type":63,"value":1300}," + ",{"type":57,"tag":86,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":63,"value":126},{"type":63,"value":1300},{"type":57,"tag":86,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":63,"value":118},{"type":63,"value":1313}," matched the intended GitHub repository.",{"type":57,"tag":255,"props":1315,"children":1316},{},[1317,1319,1324,1326,1332],{"type":63,"value":1318},"A successful publish returned exit code ",{"type":57,"tag":86,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":63,"value":968},{"type":63,"value":1325}," and the analysis reached ",{"type":57,"tag":86,"props":1327,"children":1329},{"className":1328},[],[1330],{"type":63,"value":1331},"processing_status: complete",{"type":63,"value":413},{"type":57,"tag":255,"props":1334,"children":1335},{},[1336,1338,1343,1345,1350],{"type":63,"value":1337},"The resulting alerts carry a security severity (critical\u002Fhigh\u002Fmedium\u002Flow) — confirming the\n",{"type":57,"tag":86,"props":1339,"children":1341},{"className":1340},[],[1342],{"type":63,"value":14},{"type":63,"value":1344}," tag and ",{"type":57,"tag":86,"props":1346,"children":1348},{"className":1347},[],[1349],{"type":63,"value":266},{"type":63,"value":1351}," survived finalize.",{"type":57,"tag":66,"props":1353,"children":1355},{"id":1354},"escalation",[1356],{"type":63,"value":1357},"Escalation",{"type":57,"tag":251,"props":1359,"children":1360},{},[1361,1378],{"type":57,"tag":255,"props":1362,"children":1363},{},[1364,1369,1371,1376],{"type":57,"tag":155,"props":1365,"children":1366},{},[1367],{"type":63,"value":1368},"Multitool not available",{"type":63,"value":1370}," — Neither ",{"type":57,"tag":86,"props":1372,"children":1374},{"className":1373},[],[1375],{"type":63,"value":1023},{"type":63,"value":1377}," nor a global install succeeded. Report the gap;\nthe SARIF cannot be published from this environment.",{"type":57,"tag":255,"props":1379,"children":1380},{},[1381,1394,1396,1402],{"type":57,"tag":155,"props":1382,"children":1383},{},[1384,1386,1392],{"type":63,"value":1385},"Repeated 4xx \u002F non-",{"type":57,"tag":86,"props":1387,"children":1389},{"className":1388},[],[1390],{"type":63,"value":1391},"complete",{"type":63,"value":1393}," status",{"type":63,"value":1395}," — After confirming target, ref, commit, and token scope,\ncapture the analysis ",{"type":57,"tag":86,"props":1397,"children":1399},{"className":1398},[],[1400],{"type":63,"value":1401},"errors",{"type":63,"value":1403}," body the verb prints (it contains no secret) and escalate to the\nrepository's Advanced Security administrator.",{"type":57,"tag":1405,"props":1406,"children":1407},"style",{},[1408],{"type":63,"value":1409},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1411,"total":713},[1412],{"slug":4,"name":4,"fn":5,"description":6,"org":1413,"tags":1414,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1415,1416,1417,1418,1419],{"name":21,"slug":22,"type":15},{"name":24,"slug":25,"type":15},{"name":17,"slug":18,"type":15},{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"items":1421,"total":1614},[1422,1444,1465,1486,1499,1516,1527,1540,1555,1570,1589,1602],{"slug":1423,"name":1423,"fn":1424,"description":1425,"org":1426,"tags":1427,"stars":1441,"repoUrl":1442,"updatedAt":1443},"rushstack-best-practices","manage Rush monorepos with best practices","Provides best practices and guidance for working with Rush monorepos. Use when the user is working in a Rush-based repository, asks about Rush commands (install, update, build, rebuild), needs help with project selection, dependency management, build caching, subspace configuration, or troubleshooting Rush-specific issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1428,1431,1434,1435,1438],{"name":1429,"slug":1430,"type":15},"Engineering","engineering",{"name":1432,"slug":1433,"type":15},"Local Development","local-development",{"name":9,"slug":8,"type":15},{"name":1436,"slug":1437,"type":15},"Project Management","project-management",{"name":1439,"slug":1440,"type":15},"Rush","rush",6484,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frushstack","2026-04-06T18:34:44.965032",{"slug":1445,"name":1445,"fn":1446,"description":1447,"org":1448,"tags":1449,"stars":1462,"repoUrl":1463,"updatedAt":1464},"azure-ai-agents-persistent-dotnet","build AI agents with Azure .NET SDK","Azure AI Agents Persistent SDK for .NET. Low-level SDK for creating and managing AI agents with threads, messages, runs, and tools. Use for agent CRUD, conversation threads, streaming responses, function calling, file search, and code interpreter. Triggers: \"PersistentAgentsClient\", \"persistent agents\", \"agent threads\", \"agent runs\", \"streaming agents\", \"function calling agents .NET\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1450,1453,1456,1459],{"name":1451,"slug":1452,"type":15},".NET","net",{"name":1454,"slug":1455,"type":15},"Agents","agents",{"name":1457,"slug":1458,"type":15},"Azure","azure",{"name":1460,"slug":1461,"type":15},"LLM","llm",2804,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills","2026-07-03T16:32:10.297433",{"slug":1466,"name":1466,"fn":1467,"description":1468,"org":1469,"tags":1470,"stars":1462,"repoUrl":1463,"updatedAt":1485},"azure-ai-anomalydetector-java","build anomaly detection applications with Java","Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate\u002Fmultivariate anomaly detection, time-series analysis, or AI-powered monitoring.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1471,1474,1475,1478,1481,1482],{"name":1472,"slug":1473,"type":15},"Analytics","analytics",{"name":1457,"slug":1458,"type":15},{"name":1476,"slug":1477,"type":15},"Data Analysis","data-analysis",{"name":1479,"slug":1480,"type":15},"Java","java",{"name":9,"slug":8,"type":15},{"name":1483,"slug":1484,"type":15},"Monitoring","monitoring","2026-05-13T06:14:16.261754",{"slug":1487,"name":1487,"fn":1488,"description":1489,"org":1490,"tags":1491,"stars":1462,"repoUrl":1463,"updatedAt":1498},"azure-ai-contentsafety-java","build content moderation applications with Azure AI","Build content moderation applications with Azure AI Content Safety SDK for Java. Use when implementing text\u002Fimage analysis, blocklist management, or harm detection for hate, violence, sexual content, and self-harm.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1492,1495,1496,1497],{"name":1493,"slug":1494,"type":15},"AI Infrastructure","ai-infrastructure",{"name":1457,"slug":1458,"type":15},{"name":1479,"slug":1480,"type":15},{"name":13,"slug":14,"type":15},"2026-07-07T06:53:31.293235",{"slug":1500,"name":1500,"fn":1501,"description":1502,"org":1503,"tags":1504,"stars":1462,"repoUrl":1463,"updatedAt":1515},"azure-ai-contentsafety-py","detect harmful content with Azure AI Content Safety","Azure AI Content Safety SDK for Python. Use for detecting harmful content in text and images with multi-severity classification.\nTriggers: \"azure-ai-contentsafety\", \"ContentSafetyClient\", \"content moderation\", \"harmful content\", \"text analysis\", \"image analysis\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1505,1506,1509,1510,1511,1514],{"name":1457,"slug":1458,"type":15},{"name":1507,"slug":1508,"type":15},"Compliance","compliance",{"name":1460,"slug":1461,"type":15},{"name":9,"slug":8,"type":15},{"name":1512,"slug":1513,"type":15},"Python","python",{"name":13,"slug":14,"type":15},"2026-07-18T05:14:23.017504",{"slug":1517,"name":1517,"fn":1518,"description":1519,"org":1520,"tags":1521,"stars":1462,"repoUrl":1463,"updatedAt":1526},"azure-ai-language-conversations-py","implement conversational language understanding with Python","Implement Conversational Language Understanding (CLU) using the azure-ai-language-conversations Python SDK. Use when working with ConversationAnalysisClient to analyze conversation intent and entities, building NLP features, or integrating language understanding into applications.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1522,1523,1524,1525],{"name":1472,"slug":1473,"type":15},{"name":1457,"slug":1458,"type":15},{"name":1460,"slug":1461,"type":15},{"name":1512,"slug":1513,"type":15},"2026-07-31T05:54:29.068751",{"slug":1528,"name":1528,"fn":1529,"description":1530,"org":1531,"tags":1532,"stars":1462,"repoUrl":1463,"updatedAt":1539},"azure-ai-translation-text-py","translate text using Azure AI services","Azure AI Text Translation SDK for real-time text translation, transliteration, language detection, and dictionary lookup. Use for translating text content in applications.\nTriggers: \"text translation\", \"translator\", \"translate text\", \"transliterate\", \"TextTranslationClient\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1533,1536,1537,1538],{"name":1534,"slug":1535,"type":15},"API Development","api-development",{"name":1457,"slug":1458,"type":15},{"name":9,"slug":8,"type":15},{"name":1512,"slug":1513,"type":15},"2026-07-18T05:14:16.988376",{"slug":1541,"name":1541,"fn":1542,"description":1543,"org":1544,"tags":1545,"stars":1462,"repoUrl":1463,"updatedAt":1554},"azure-ai-vision-imageanalysis-py","analyze images with Azure AI Vision","Azure AI Vision Image Analysis SDK for captions, tags, objects, OCR, people detection, and smart cropping. Use for computer vision and image understanding tasks.\nTriggers: \"image analysis\", \"computer vision\", \"OCR\", \"object detection\", \"ImageAnalysisClient\", \"image caption\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1546,1547,1550,1553],{"name":1457,"slug":1458,"type":15},{"name":1548,"slug":1549,"type":15},"Computer Vision","computer-vision",{"name":1551,"slug":1552,"type":15},"Images","images",{"name":1512,"slug":1513,"type":15},"2026-07-18T05:14:18.007737",{"slug":1556,"name":1556,"fn":1557,"description":1558,"org":1559,"tags":1560,"stars":1462,"repoUrl":1463,"updatedAt":1569},"azure-appconfiguration-java","manage configuration with Azure App Configuration","Azure App Configuration SDK for Java. Centralized application configuration management with key-value settings, feature flags, and snapshots.\nTriggers: \"ConfigurationClient java\", \"app configuration java\", \"feature flag java\", \"configuration setting java\", \"azure config java\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1561,1562,1565,1568],{"name":1457,"slug":1458,"type":15},{"name":1563,"slug":1564,"type":15},"Configuration","configuration",{"name":1566,"slug":1567,"type":15},"Feature Flags","feature-flags",{"name":1479,"slug":1480,"type":15},"2026-07-03T16:32:01.278468",{"slug":1571,"name":1571,"fn":1572,"description":1573,"org":1574,"tags":1575,"stars":1462,"repoUrl":1463,"updatedAt":1588},"azure-cosmos-rust","build applications with Azure Cosmos DB","Azure Cosmos DB library for Rust (NoSQL API). Document CRUD, containers, and globally distributed data.\nTriggers: \"cosmos db rust\", \"CosmosClient rust\", \"document crud rust\", \"NoSQL rust\", \"partition key rust\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1576,1579,1582,1585],{"name":1577,"slug":1578,"type":15},"Cosmos DB","cosmos-db",{"name":1580,"slug":1581,"type":15},"Database","database",{"name":1583,"slug":1584,"type":15},"NoSQL","nosql",{"name":1586,"slug":1587,"type":15},"Rust","rust","2026-07-31T05:54:27.021432",{"slug":1590,"name":1590,"fn":1572,"description":1591,"org":1592,"tags":1593,"stars":1462,"repoUrl":1463,"updatedAt":1601},"azure-cosmos-ts","Azure Cosmos DB JavaScript\u002FTypeScript SDK (@azure\u002Fcosmos) for data plane operations. Use for CRUD operations on documents, queries, bulk operations, and container management. Triggers: \"Cosmos DB\", \"@azure\u002Fcosmos\", \"CosmosClient\", \"document CRUD\", \"NoSQL queries\", \"bulk operations\", \"partition key\", \"container.items\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1594,1595,1596,1597,1598],{"name":1577,"slug":1578,"type":15},{"name":1580,"slug":1581,"type":15},{"name":9,"slug":8,"type":15},{"name":1583,"slug":1584,"type":15},{"name":1599,"slug":1600,"type":15},"TypeScript","typescript","2026-07-03T16:31:19.368382",{"slug":1603,"name":1603,"fn":1604,"description":1605,"org":1606,"tags":1607,"stars":1462,"repoUrl":1463,"updatedAt":1613},"azure-data-tables-java","build table storage applications with Java","Build table storage applications with Azure Tables SDK for Java. Use when working with Azure Table Storage or Cosmos DB Table API for NoSQL key-value data, schemaless storage, or structured data at scale.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1608,1609,1610,1611,1612],{"name":1457,"slug":1458,"type":15},{"name":1577,"slug":1578,"type":15},{"name":1580,"slug":1581,"type":15},{"name":1479,"slug":1480,"type":15},{"name":1583,"slug":1584,"type":15},"2026-05-13T06:14:17.582229",267]