publish-to-ghas Skill
Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance. Published by microsoft in sarif-sdk.
Decision snapshot
Is this a fit?
Security review, Deployment, Includes SKILL.md, Reusable instructions
Compatibility not yet detected.
API key required authentication, Credentials required
Copy skill directory
2 months ago · NOASSERTION license
Access note: API key required.
What is publish-to-ghas Skill?
Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance. Published by microsoft in sarif-sdk. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Deployment
- Security review use cases
- Deployment use cases
Declared skill metadata
- Declared author: sarif-sdk-maintainers
- Source file: skills/publish-to-ghas/SKILL.md
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
- API key required
Requirements and access
Security and permissions
Review permissions before connecting any MCP server to an agent. Pay special attention to whether it can read local files, write data, call external services, or perform destructive actions.
When to use publish-to-ghas Skill
- Use it for security review.
- Use it for deployment.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/sarif-sdk
- Skill file: skills/publish-to-ghas/SKILL.md
What it does
Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.
Skill instructions
Publish SARIF to GHAS (GitHub code scanning) Context GitHub Advanced Security (GHAS) ingests SARIF through the GitHub code-scanning SARIF API (POST /repos/{owner}/{repo}/code-scanning/sarifs). The publish-to-ghas verb uploads a finalized SARIF file to that endpoint: it derives the GitHub owner/repo, the commitsha, and the ref from the run's version-control provenance, gzip-compresses and base64-encodes the body into the JSON payload, and posts it under a caller-supplied bearer token. The verb is the companion of publish-to-ghazdo for Azure DevOps targets, and shares its log-level refusal of an unpublishable (--no-repo) log. Publish a SARIF only after it is finalized — its first run must carry a GitHub repositoryUri, revisionId, and branch under versionControlProvenance (see emit-sarif and the emit-finalize verb). The target owner/repo, the commitsha, and the ref are read from that provenance, so an unfinalized file cannot be published. Why finalize matters for GHAS specifically emit-fi
Verified compatibility and discovery
Frequently asked questions
What is publish-to-ghas?
publish-to-ghas is a open-source AI agent skill with Copy skill directory. Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control.
Who is publish-to-ghas best for?
publish-to-ghas is best for reusing agent instructions, scripts, and references, security review workflows, deployment workflows.
How do I install publish-to-ghas?
Install or run publish-to-ghas using Copy skill directory. Check publish-to-ghas for the latest setup command.
Is publish-to-ghas actively maintained?
publish-to-ghas may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
