GitHub Actions SARIF upload failure due to missing security permissions

Issue

A GitHub Actions workflow failed to upload Trivy SARIF scan results with the error Resource not accessible by integration. This occurred when attempting to push vulnerability scan results to GitHub’s Code Scanning API, preventing the findings from appearing in the repository’s Security tab.

Culprit

The workflow lacked the security-events: write permission in its configuration. GitHub’s Code Scanning API enforces this permission to prevent unauthorized submissions of security data. The existing permissions block only included contents: read, packages: write, and id-token: write, but did not include the required security-events: write permission for SARIF uploads.

Solution

Added Missing Permission

Updated the workflow configuration to include the security-events: write permission in the permissions block:

• Security-Events: Added security-events: write to enable SARIF uploads to GitHub’s Code Scanning API.

This solution resolved the permission-related errors and ensured that the Trivy scan results were successfully uploaded to GitHub’s Security tab, enabling visibility and management of security findings in the repository.