upload-sarif "Path does not exist" / SARIF results not found in CI

The upload-sarif action reads the file (or directory) named by sarif_file. If the scan step failed, wrote elsewhere, or the path is wrong, the action reports the path does not exist and no results are uploaded.

What this error means

upload-sarif fails with "Path does not exist: results.sarif" or "SARIF results were not found", usually because the preceding scan did not write the file where expected.

Error: Path does not exist: results.sarif
No SARIF results were found to upload.

Common causes

The scan step failed before writing SARIF

A scanner that exits non-zero on findings may skip writing output, so the upload step finds no file.

The path or output directory is wrong

The scanner wrote to a different filename or directory than sarif_file points to.

How to fix it

Write SARIF even when the scan finds issues

1. Configure the scanner to always emit SARIF, regardless of exit code.
2. Run the scan with continue-on-error so upload still runs.
3. Point sarif_file at the exact output path.

- name: Scan
  continue-on-error: true
  run: semgrep --sarif --output semgrep.sarif --config auto
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: semgrep.sarif

Match the output path exactly

Ensure the scanner output filename and the sarif_file value are identical, including any subdirectory.

How to prevent it

• Always write SARIF even on findings, and upload with if: always().
• Keep the scanner output path and sarif_file in sync.
• Fail the job on the gate step, not by skipping the upload.

Related guides