Feature request: specify category/file mapping for parallel uploads in upload-sarif #4282

Activity

1. Pr0methean commented on Nov 1, 2026

   

   Pr0methean

   on Nov 1, 2026

   Author

   More actions

   For example, after these two runs:

         - name: Run clippy - inside bash for pipefail
           shell: bash
           # allow warnings but not errors
           run: cargo clippy --workspace ${{ matrix.feature_flag }} --manifest-path ${{ github.workspace }}/Cargo.toml --message-format=json -- -D warnings | clippy-sarif | tee sarif/rust-clippy-results.sarif | sarif-fmt
         - name: Run clippy - inside bash for pipefail
           shell: bash
           # allow warnings but not errors
           run: cargo clippy --workspace ${{ matrix.feature_flag }} --manifest-path ${{ github.workspace }}/fuzz/Cargo.toml --message-format=json -- -D warnings | clippy-sarif | tee sarif/fuzz-clippy-results.sarif | sarif-fmt
   

   then if the feature existed, I would've replaced this:

         - name: Upload analysis results to GitHub
           if: always()
           uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
           with:
             sarif_file: sarif
             wait-for-processing: true
   

   with this:

         - name: Upload analysis results to GitHub
           if: always()
           uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
           with:
             sarif_files:
               main: sarif/rust-clippy-results.sarif
               fuzz: sarif/fuzz-clippy-results.sarif
             wait-for-processing: true
   
2. mbg commented on Nov 2, 2026

   

   mbg

   on Nov 2, 2026

   Member

   More actions

   Hi @Pr0methean,

   Just to clarify, the blog post you linked to isn't saying that we don't support combining multiple SARIF files anymore, but only that we no longer allow multiple SARIF files to be combined if they share the same tool and category properties. This was arguably never sensible, because (as in your case) the two SARIF files relate to different analyses, and combining results with the same tool and category is indicative of a misconfiguration that might lead to unexpected results / loss of results.

   In other words, this shouldn't get in the way of your use case as long as you configure different analysis categories (run.automationDetails.id in SARIF) for the two SARIF files. I am not familiar with clippy-sarif to know whether there's an option to specify the analysis category it includes or not. A quick look over the docs and https://github.com/psastras/sarif-rs/blob/main/clippy-sarif/src/bin.rs#L93 suggests there isn't, so you could either just manipulate the SARIF yourself to insert appropriate automation IDs or perhaps contribute that functionality to clippy-sarif itself. Then you would only need one codeql-action/upload-sarif step afterwards. The codeql-action/upload-sarif action will only insert an automatically generated automation ID if no automationDetails object is already present for a given run object.