How to filter alerts by custom category ?

[musabmasood]

Select Topic Area

Code Scanning and security

Body

Hello.

I need some help in filtering alerts by custom category in Code Scanning (security). I have a mono repo and I am uploading custom results.sarif files using a matrix setup (different helm charts and values etc). The results.sarif file is generated by my tool (checkov).

For each scan, I am uploading my own results.sarif file as like this:

      - uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ./results.sarif
          category: mycategory

The upload is successful and I can also see it with the curl:

curl \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer $(cat ~/.ssh/gh-token-personal)" \
  -H "X-GitHub-Api-Version: 2022-11-28"  \
  https://api.github.com/repos/xxx/yyy/code-scanning/analyses  | jq

Partial result:

{
    "ref": "refs/pull/xxx/merge",
    "commit_sha": "xxxx",
    "analysis_key": ".github/workflows/xxx.yml:xxx",
    "category": "mycategory",
    "results_count": 132,
    "rules_count": 15,
    "sarif_id": "xxxxxxxx",
}

However I am not finding a way to filter these alerts based on my category in the UI:

Can someone please help me on this?

[sampart]

Hi @musabmasood, thanks for getting in touch. Filtering by category isn't something the UI supports at present, but I've brought your request to the attention of our product team.

You mentioned that you have a mono-repo; I don't know whether you'd find the path filter helpful? This is available via the filter bar:

Best wishes,
Sam

[musabmirza-amperon]

Hi @sampart

Thanks for the info.

The Path filter doesn't help as we really want to use the category to segment out things for us e.g. kubernetes-application-services, kubernetes-system-services etc.

[khvn26]

Upvoted the discussion for more visibility.

Consider exposing a sarif_id filter too, if possible; I'd love to be able to get reports per upload.

[sampart]

Thanks for the feedback, @khvn26. I've sent that to our Product folk.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬