Code Scanning "could not process the submitted SARIF file" in CI

By Daniel Zoghalchali·Latchkey

GitHub validates uploaded SARIF against a schema and a set of rules before ingesting it. A structural error, missing required fields, or invalid result locations causes it to reject the whole file with a processing error.

What this error means

upload-sarif fails, or the code scanning API returns "Code Scanning could not process the submitted SARIF file", sometimes with a specific validation message.

Error: Code Scanning could not process the submitted SARIF file:
sarif schema validation failed with error: instance.runs[0].results[0].locations is required

Common causes

The SARIF is invalid against the schema

A tool produced SARIF missing required fields (tool driver, rule ids, result locations) or with the wrong structure.

Invalid or absolute result locations

Locations use absolute paths, URIs GitHub cannot map to the repo, or reference files outside the checkout.

How to fix it

Validate the SARIF before uploading

1. Run a SARIF validator or the CodeQL CLI to check the file.
2. Fix the field or location the validator flags.
3. Upload the corrected SARIF.

codeql github upload-results --sarif=results.sarif --dry-run || true
npx @microsoft/sarif-multitool validate results.sarif

Emit repo-relative result locations

Configure the scanner to write paths relative to the repository root so GitHub can map results to files.

How to prevent it

• Validate SARIF in CI before upload.
• Emit repo-relative paths in result locations.
• Pin the scanner version so its SARIF output stays schema-valid.

Frequently asked questions

Related guides

References

• GitHub Actions documentation