Yes. GitHub code scanning accepts results from third-party tools that output SARIF, the Static Analysis Results Interchange Format. You can run the tool in GitHub Actions or an external CI system and upload the file, and the findings then show as code scanning alerts.
What SARIF is
SARIF is an open standard for describing static analysis results: rule, severity, file, line and message. Because it is a common format, one place can display findings from several tools. GitHub's own engine, CodeQL, is shown through the same alerts interface.
Two ways to get results in
| Method | How it works | Good for |
|---|---|---|
| Run in GitHub Actions | A workflow step runs the tool and uploads SARIF | Teams already on Actions |
| Upload from external CI | Your CI produces a SARIF file and uploads it | Jenkins, GitLab CI or others |
Both routes end with the same alert view in the repository. Code scanning itself runs on Actions, and each workflow run consumes Actions minutes, so account for that cost in your plan.
Why bother
- You can cover languages CodeQL does not support, such as PHP and Scala.
- You can keep the tool your team already trusts.
- You can use the code scanning merge protection rule with more than one tool. In a branch ruleset, you add each tool and set its own thresholds.
What to check after the first upload
- Severity mapping. Confirm the tool's severities show up sensibly, since thresholds rely on them.
- Locations. Make sure file paths resolve to real files in the repository.
- Duplicates. Two tools may flag the same issue. Decide which one owns it.
- Alert lifecycle. An alert closes automatically after the flagged code is fixed. Confirm that happens with your tool's output.
- Private repositories. Code scanning on private repos needs a GitHub Code Security license.
A practical rollout
- Pick one tool for a language CodeQL does not cover.
- Upload on pull requests and on the default branch.
- Review alerts for two weeks without blocking.
- Add the tool to your branch ruleset with a conservative threshold.
- Review the ratio of fixed to dismissed alerts monthly.
Where a dedicated scanner fits
If you are already collecting results from several tools, a platform that normalizes them and applies one policy can reduce the juggling. Safeguard has a CLI that sends detect results to GitHub code scanning, and a free scan at gold.safeguard.sh/scan. See how to send Safeguard CLI detect results to GitHub code scanning.
Quick check
Does the tool have to run in GitHub Actions?
No. You can run it in an external CI system and upload the SARIF file.
Does SARIF upload avoid license needs on private repos?
No. The documentation says using code scanning on private repositories requires a GitHub Code Security license.
Sources
Last reviewed: 19 October 2026.
