Comma

Share CodeQL results

CodeQL's findings render beautifully — inside the repository's security tab, which is gated on repo permissions. The people who most often need to read them are the ones you are least likely to give repo access to: an auditor, a customer's security team, a contractor on one service.

Render the SARIF

codeql database analyze db \
  --format=sarif-latest --output=codeql.sarif \
  codeql/javascript-queries

jq -r '
  def sev: (.properties."security-severity" // "") ;
  "<table><tr><th>Rule</th><th>Severity</th><th>File</th><th>Line</th><th>Message</th></tr>"
  + ([ .runs[].results[]
       | "<tr><td>" + .ruleId
         + "</td><td>" + ((.properties."security-severity") // "-")
         + "</td><td>" + (.locations[0].physicalLocation.artifactLocation.uri // "-")
         + "</td><td>" + ((.locations[0].physicalLocation.region.startLine // 0) | tostring)
         + "</td><td>" + (.message.text | gsub("<"; "&lt;")) + "</td></tr>" ] | add)
  + "</table>"
' codeql.sarif > codeql.html

Publish it from the same workflow that ran the analysis:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html codeql.html \
        --arg title "CodeQL — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

Keep it private or team-only by default, and use a domain-gated link for an external reviewer — see the sharing model.

Why publish rather than grant access

  • Anchored threads — "false positive, the sink is parameterised" sits on the alert and survives the next scan. See commenting on HTML.
  • Revisions — one report id per branch; alert churn is visible as a diff.
  • Access per report — an auditor gets one report, not your source tree.

Limits

  • Entry HTML: 5 MB. A large SARIF with code-flow paths can exceed it; render the flows for high-severity results only.
  • Assets: 25 MB per file, 250 MB and 500 files per report.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scanning report →

Related