# Share CodeQL Results — SARIF Rendered for People Without Repo Access

Canonical: https://commareports.com/share-codeql-results
Published: 2026-09-12

> CodeQL emits SARIF, which GitHub renders only inside the repo's security tab. Render the SARIF to HTML and publish it to Comma so reviewers without access can read and triage the alerts.

# Share CodeQL results

CodeQL's findings render beautifully — inside the repository's security tab,
which is gated on repo permissions. The people who most often need to read
them are the ones you are least likely to give repo access to: an auditor, a
customer's security team, a contractor on one service.

## Render the SARIF

```bash
codeql database analyze db \
  --format=sarif-latest --output=codeql.sarif \
  codeql/javascript-queries

jq -r '
  def sev: (.properties."security-severity" // "") ;
  "<table><tr><th>Rule</th><th>Severity</th><th>File</th><th>Line</th><th>Message</th></tr>"
  + ([ .runs[].results[]
       | "<tr><td>" + .ruleId
         + "</td><td>" + ((.properties."security-severity") // "-")
         + "</td><td>" + (.locations[0].physicalLocation.artifactLocation.uri // "-")
         + "</td><td>" + ((.locations[0].physicalLocation.region.startLine // 0) | tostring)
         + "</td><td>" + (.message.text | gsub("<"; "&lt;")) + "</td></tr>" ] | add)
  + "</table>"
' codeql.sarif > codeql.html
```

Publish it from the same workflow that ran the analysis:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html codeql.html \
        --arg title "CodeQL — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

Keep it private or team-only by default, and use a domain-gated link for an
external reviewer — see the [sharing model](/docs/sharing).

## Why publish rather than grant access

- **Anchored threads** — "false positive, the sink is parameterised" sits on
  the alert and survives the next scan. See
  [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per branch; alert churn is visible as a diff.
- **Access per report** — an auditor gets one report, not your source tree.

## Limits

- **Entry HTML: 5 MB.** A large SARIF with code-flow paths can exceed it;
  render the flows for high-severity results only.
- **Assets: 25 MB per file, 250 MB and 500 files per report.**
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scanning report →](https://commareports.com/)**

### Related

- [Share a SARIF report](/share-sarif-report) · [What is SARIF?](/glossary/sarif)
- [Share a Semgrep report](/share-semgrep-report) · [Share a Nuclei report](/share-nuclei-report)
- [Share a security scan report](/share-security-scan-report) · [For security teams](/for/security-teams)