SARIF upload category collision in code scanning in CI

By Kaveh Alemi·Latchkey

Code scanning keys results by category. When two uploads in the same commit use the same category (or none), the later upload replaces the earlier one and findings from one tool or matrix leg disappear.

What this error means

Findings from one scanner or matrix leg vanish, or code scanning shows fewer results than expected, because two upload-sarif calls used the same (or a default) category.

Warning: Uploaded SARIF for category "/language:java" replaces a previous
upload for the same category in this commit.

Common causes

Multiple uploads share one category

Two tools (or two matrix legs) upload under the same category, so the second overwrites the first for that commit.

No explicit category is set

Without a category, uploads default to the same key and collide instead of coexisting.

How to fix it

Give each upload a unique category

1. Assign a distinct category per tool and per matrix leg.
2. Keep the category stable across runs so trends persist.
3. Re-run so results coexist rather than overwrite.

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: semgrep.sarif
    category: semgrep
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: snyk.sarif
    category: snyk-code

Include the matrix language in the category

For per-language scans, embed the language so each leg uploads under its own key.

category: ${{ matrix.language }}

How to prevent it

• Set a unique, stable category on every upload.
• Incorporate tool name and matrix leg into the category.
• Avoid default categories when multiple tools upload.

Frequently asked questions

Related guides

References

• GitHub Actions documentation