The usual cause is the result's location. GitHub code scanning needs at least one location with a file path and start line, uses only the first location, and shows an alert in a pull request only when all its lines are in the diff. Check the SARIF region, then the fingerprint.
What the SARIF fields must hold
GitHub's SARIF documentation lists what a result needs to appear.
| Field | What GitHub says |
|---|---|
| locations | At least one location is required for code scanning to display a result. Only the first location is used |
| artifactLocation uri | Required. The file path, ideally relative to the repository root |
| region startLine, startColumn | Required, giving the first character of the result |
| partialFingerprints | Used to match results across runs so duplicate alerts are not created |
| ruleId | Identifies the rule and must stay the same across analyses |
| message text | Required. Shown as the title, and only the first sentence is shown when space is limited |
The documentation also notes an inconsistency: the table marks endLine and endColumn as required, but its minimal example leaves out endLine. Provide both to be safe.
Why accurate regions matter
The documentation states that alerts appear in the file, and in pull requests only when all their lines are in the diff. So a result whose region spans lines you did not change will not show as an inline pull request annotation, even though it exists as an alert elsewhere. A very wide region, for example a whole function, is less likely to sit entirely in a diff than a tight one on the offending line.
A checklist for a missing alert
- Confirm the upload succeeded. Look at the workflow logs for the upload step and any warnings about the file.
- Open the SARIF file. Does the result have a locations array with a physical location?
- Check the path. It should be relative to the repository root. A path that includes a build directory, or an absolute path from the runner, may not match any file.
- Check the region. Is startLine present and sensible? Does it point at a line that exists?
- Compare the region with the diff. If the lines are outside the changed hunks, the alert will not appear on the pull request. Look in the repository's alerts list instead.
- Check the severity and rule data. GitHub uses the result level and the rule's security severity to filter. If a filter hides lower levels, the alert may be filtered, not missing.
- Check the fingerprints. If an alert seems to be treated as already known, a stable partial fingerprint may be matching it to an earlier result.
Duplicate alerts, the opposite problem
When alerts appear twice, the documentation points at fingerprints. Code scanning only uses the primaryLocationLineHash partial fingerprint. If it is missing from a file uploaded with the upload action, GitHub tries to populate it, and uploads through the API without it can produce duplicate alerts. So, supply the fingerprint when you generate SARIF yourself.
Severity and ordering
Results carry a level of note, warning or error, which a result-level value can override from the rule default. For security rules, a security-severity property from above 0.0 up to 10.0 marks the rule as a security rule, and GitHub maps score bands to severity labels. A precision property of very-high, high, medium or low tells GitHub how often a rule's results are true, and GitHub uses precision with severity to order results. If your result list looks unsorted, check that the rule metadata is present.
What to tell the scanner team
If the cause is on the tool side, send them the SARIF snippet with the location block and the diff hunk that should have contained it. That pair is the fastest way to a fix.
Safeguard's policies, gates and guardrails apply to pull requests, so a finding blocks or passes a change where developers already work. A free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a finding is tied to a changed line.
Quick check
Does GitHub use every location in a SARIF result?
No. It uses only the first location, and at least one location is required for a result to display.
Why do duplicate alerts appear?
Often the partial fingerprint is missing. Code scanning only uses primaryLocationLineHash, and uploads without it can produce duplicates.
Sources
- GitHub Docs, SARIF support for code scanning
Last reviewed: 19 October 2026.
