skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

publish-to-ghazdo

Publish finalized SARIF files to GitHub Advanced Security for Azure DevOps.

224|105|Updated Nov 5, 2015
Search Tags:#automation#workflow#security#publish#azure-devops#sarif#ghazdo
One-click install
npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghazdo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: publish-to-ghazdo
Source: https://github.com/microsoft/sarif-sdk/tree/main/skills/publish-to-ghazdo
Command: npx skills add https://github.com/microsoft/sarif-sdk --skill publish-to-ghazdo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the secure submission of finalized SARIF files to GitHub Advanced Security for Azure DevOps (GHAzDO) via the Sarif.Multitool publish-to-ghazdo verb.

Core Features & Use Cases

  • Automates publishing finalized SARIF to GHAzDO, ensuring provenance requirements are met.
  • Supports dry-run and live publish flows with environment-variable secret handling.
  • Validates provenance offline to prevent misconfigured or unfinalized SARIF from being ingested.

Quick Start

Run Sarif.Multitool publish-to-ghazdo against your finalized SARIF file and supply the secret via an environment variable (default GHAZDO_TOKEN) after confirming the target org/project/repo.

Frequently Asked Questions about publish-to-ghazdo

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I publish a finalized SARIF file to GitHub Advanced Security for Azure DevOps?▼

To publish a finalized SARIF file to GHAzDO, run the Sarif.Multitool publish-to-ghazdo verb with an environment variable secret like a PAT or Entra token to authenticate the upload.

Does uploading SARIF to GHAzDO require a specific authentication token?▼

Yes, uploading SARIF to GHAzDO requires a secret in an environment variable, defaulting to GHAZDO_TOKEN, which uses a PAT or Entra token to authenticate the request.

How do I validate SARIF provenance before publishing to Azure DevOps?▼

You can validate SARIF provenance offline using GHAzDO rules to ensure versionControlProvenance is correctly configured, preventing misconfigured or unfinalized files from being ingested.

Can I preview a SARIF upload to GHAzDO before submitting it?▼

Yes, you can perform a dry-run preview to verify the target org, project, and repo resolution before executing the final publish flow to the configured endpoint.

What endpoint does GHAzDO use for SARIF ingestion?▼

GHAzDO SARIF ingestion targets advsec.dev.azure.com for upload resolution, falling back to dev.azure.com based on the repository provenance described in the file.

Why does my SARIF publish to GHAzDO fail with a provenance error?▼

Publishing fails when the SARIF file lacks proper versionControlProvenance or is unfinalized, which offline GHAzDO rules validation checks to prevent misconfigured ingestion.

Related Skills

Explore More Software Engineering Skills→
jusjinukjusjinuk
1

onboard

Configure Slack tokens, environment files, and repository hooks for internbot deployment.

Community
Intermediate
fitlab-aifitlab-ai
84

import-codescan

Import Code Scanning alerts and create remediation task skeletons.

Official
Intermediate
sbknanasbknana
10

sarif-parsing

Parse SARIF files to deduplicate findings and generate structured reports.

Community
Advanced
albertoiruruetaalbertoirurueta

pr-review

Automate pull request reviews across GitHub, Bitbucket, Azure DevOps, and TFS.

Community
Advanced