View SARIF reports when there are no GHAS license

[dimapasko]

I configured GitHub action with reposaur/repo-audit-action@main to check all my organization repositories.
GitHub action output says:

INF Wrote 12 reports to /home/runner/work/idp-github-policies/idp-github-policies/.reposaur
INF Uploaded 12 reports to GHAS

We have enterprise licencse but there are no GHAS license available(all repos are internal).

Could you give piece of advice how could i view this reports?
Should i have GHAS license for this?
Maybe there are some workarounds.

[dimapasko]

May i suggest an option to get report as job summary
https://github.blog/2022-05-09-supercharging-github-actions-with-job-summaries if GHES is not enabled

[jcrqr]

Hey @dimapasko - sorry for late reply I have some issue with my GitHub notifications. I really think that for now that's the only option you've without having GHAS. Thanks for the suggestion.

I'll look into it over this week and try to implement it in the action and let you know.

BTW, you can still have GHAS for internal repositories if you have GitHub Enterprise Cloud or GitHub Enterprise Server (see https://docs.github.com/en/billing/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security).

[dimapasko]

It would be great to have a fallback scenario in case you don't have access to GHAS.

We currently have GitHub Enterprise Cloud licenses but GHAS is an additional cost, so we don't have it yet.