publish-to-ghazdo Skill
Uploads a finalized SARIF file to GitHub Advanced Security for Azure DevOps (GHAzDO) using the Sarif.Multitool publish-to-ghazdo verb. Published by microsoft in sarif-sdk.
What is publish-to-ghazdo Skill?
Uploads a finalized SARIF file to GitHub Advanced Security for Azure DevOps (GHAzDO) using the Sarif.Multitool publish-to-ghazdo verb. Published by microsoft in sarif-sdk. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Deployment
- Security review use cases
- Deployment use cases
Technical details
- Install or run with Copy skill directory
When to use publish-to-ghazdo Skill
- Use it for security review.
- Use it for deployment.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/sarif-sdk
- Skill file: skills/publish-to-ghazdo/SKILL.md
What it does
Uploads a finalized SARIF file to GitHub Advanced Security for Azure DevOps (GHAzDO) using the Sarif.Multitool publish-to-ghazdo verb.
Skill instructions
Publish SARIF to GHAzDO Context GitHub Advanced Security for Azure DevOps (GHAzDO) ingests SARIF through the Advanced Security alert API. The publish-to-ghazdo verb uploads a finalized SARIF file to that endpoint: it derives the Azure DevOps target from the run's version-control provenance, compresses the body, and posts it under a caller-supplied bearer secret. Publish a SARIF only after it is finalized — its first run must carry an Azure DevOps repositoryUri and revisionId under versionControlProvenance (see emit-sarif and the emit-finalize verb). The target organization, project, and repository are read from that provenance, so an unfinalized file cannot be published. Security model This is the security-critical part of the skill. Follow it exactly. - The secret never appears on the command line. Place the secret in an environment variable and name that variable with --token-env-var (default GHAZDOTOKEN). The verb reads the value from the environment; it is never an argument, and it
Explore related resources
Frequently asked questions
What is publish-to-ghazdo?
publish-to-ghazdo is a open-source AI agent skill with Copy skill directory. Uploads a finalized SARIF file to GitHub Advanced Security for Azure DevOps (GHAzDO) using the Sarif.Multitool publish-to-ghazdo verb.
Who is publish-to-ghazdo best for?
publish-to-ghazdo is best for reusing agent instructions, scripts, and references, security review workflows, deployment workflows.
How do I install publish-to-ghazdo?
Install or run publish-to-ghazdo using Copy skill directory. Check publish-to-ghazdo for the latest setup command.
Is publish-to-ghazdo actively maintained?
publish-to-ghazdo may need a closer maintenance check before production use.
Auto-fetched from GitHub.
