CodeQL "You are not authorized to upload SARIF" in CI

By Daniel Zoghalchali·Latchkey

The SARIF upload was authenticated but rejected on authorization: the identity behind the token is not allowed to write code scanning results to this repository, or code scanning is not available for it.

What this error means

upload-sarif fails with "You are not authorized to upload SARIF results" or a 403 that is not the generic "Resource not accessible by integration".

Error: You are not authorized to upload SARIF results for this repository.
Ensure code scanning is enabled and the token has write access.

Common causes

A PAT or app token without code scanning write

A custom token (PAT or GitHub App) is used for upload but lacks the code scanning write scope for the target repository.

Uploading to a repository you cannot write to

The workflow targets a different repo (fork, upstream) whose code scanning the token identity may not write.

How to fix it

Use a token with code scanning write

1. Prefer the built-in GITHUB_TOKEN with security-events: write.
2. If using a PAT/app token, grant it code scanning (security events) write on the target repo.
3. Confirm the upload targets the correct repository.

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
    token: ${{ secrets.GITHUB_TOKEN }}

Verify the target repository

Ensure sarif_file is uploaded to the repo where the identity has write access, not an upstream you only read.

How to prevent it

• Use GITHUB_TOKEN with explicit security-events: write for uploads.
• Scope any PAT/app token to code scanning write on the right repo.
• Avoid cross-repo uploads unless the identity is authorized.

Frequently asked questions

Related guides

References

• GitHub Actions documentation