@@ -12,6 +12,10 @@ jobs:
   test-changed:
     name: Test mode=changed
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # gh pr diff
+      security-events: write # the action reports its version check to code scanning
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -25,6 +29,8 @@ jobs:
   test-platforms:
     name: Test on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read # no security-events: the action has to do without the code scanning upload
     strategy:
       fail-fast: false
       matrix:
 
@@ -22,6 +22,7 @@ v2 is for open-java-format 2.98.0.2 and later, which has a single style. A workf
 |-------|----------|---------|-------------|
 | `version` | yes | `2.98.0.6` | Version of the open-java-format native binary, one of those on [Maven Central](https://repo1.maven.org/maven2/dev/openjavaformat/open-java-format-native/) |
 | `mode` | no | `changed` | `changed` — only files from PR or push; `all` — every `.java` file in repo |
+| `code-scanning` | no | `true` | Report the version check to [code scanning](#code-scanning) as well; `false` keeps it to the log warning |
 
 ## How `mode: changed` works
 
@@ -33,6 +34,7 @@ v2 is for open-java-format 2.98.0.2 and later, which has a single style. A workf
 
 - If all files are formatted correctly → passes ✅
 - If any file has formatting issues → lists unformatted files and fails ❌
+- If a newer open-java-format release is out → warns in the job log, and raises a [code scanning alert](#code-scanning) when the job allows it
 
 Files are checked in the open-java-format style, the formatter's only style. When the check fails, fix locally with a native binary or the runnable jar from the [open-java-format releases](https://github.com/openjavaformat/open-java-format/releases):
 
@@ -86,6 +88,38 @@ jobs:
           mode: ${{ github.event_name == 'push' && 'all' || 'changed' }}
 ```
 
+## Code scanning
+
+The action compares the `version` it runs with the latest [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) and warns in the job log when a newer one is out. A log warning is easy to miss, so the check is also reported to code scanning: the action uploads a SARIF file with one alert while the version is behind, and with none once it is current, which closes the alert. The alert shows up under **Security → Code scanning** and in the **Code scanning results** check on pull requests, and points at the line of the workflow that names the version.
+
+The upload needs the `security-events: write` permission, which a job gets like this:
+
+```yaml
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # mode: changed reads the files of the pull request
+      security-events: write # the action reports its version check to code scanning
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: openjavaformat/open-java-format-action@v2
+        with:
+          version: '2.98.0.6'
+```
+
+Without the permission the upload is skipped with a line in the log, the check passes as before, and the log warning stays. Code scanning is free on public repositories; a private repository needs [GitHub Code Security](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) enabled. Pull requests from forks run with a read-only token and get the log warning only. To stop the upload altogether, set `code-scanning: false`.
+
+One report per job is enough. When the job runs on a matrix, enable it on one leg only:
+
+```yaml
+        with:
+          version: '2.98.0.6'
+          code-scanning: ${{ matrix.os == 'ubuntu-latest' }}
+```
+
 ## Git pre-commit hook
 
 You can also use the same formatter as a local git hook to catch formatting issues before they reach CI.
 
@@ -15,6 +15,10 @@ inputs:
     description: 'Which files to check: "changed" for files from PR/push, "all" for every .java file'
     required: false
     default: 'changed'
+  code-scanning:
+    description: 'Report the version check to code scanning as well: "true" raises an alert under Security → Code scanning while a newer open-java-format is out, "false" keeps the check to the log warning. The upload needs the security-events: write permission and is skipped without it.'
+    required: false
+    default: 'true'
 
 runs:
   using: 'composite'
@@ -52,6 +56,7 @@ runs:
         echo "binary=$BINARY" >> "$GITHUB_OUTPUT"
 
     - name: Check for newer open-java-format version
+      id: latest
       shell: bash
       env:
         GH_TOKEN: ${{ github.token }}
@@ -70,12 +75,150 @@ runs:
           https://api.github.com/repos/openjavaformat/open-java-format/releases/latest 2>/dev/null \
           | jq -r '.tag_name // empty' 2>/dev/null || true)
 
+        echo "version=$LATEST" >> "$GITHUB_OUTPUT"
         if [ -z "$LATEST" ]; then
           echo "Could not check the latest open-java-format version — skipping this check."
         elif [ "$LATEST" != "$VERSION" ]; then
           echo "::warning::A newer open-java-format version is available: $LATEST (you are using $VERSION)"
         fi
 
+    - name: Report the version check to code scanning
+      if: inputs.code-scanning == 'true' && steps.latest.outputs.version != ''
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        VERSION: ${{ inputs.version }}
+        LATEST: ${{ steps.latest.outputs.version }}
+      run: |
+        # A log warning is easy to miss, so the check is also handed to code scanning: a SARIF
+        # file with one alert while a newer release is out, and with none once the version is
+        # current, which closes the alert. The alert sits on the line of this repository's
+        # workflow that names the version, so that it points at what to change. The upload goes
+        # straight to the REST API: github/codeql-action/upload-sarif fails the job when the
+        # permission is missing, and this must stay best-effort, like the check itself — nothing
+        # here may fail the build.
+        case "$GITHUB_REF" in
+          refs/heads/*|refs/tags/*|refs/pull/*) ;;
+          *) echo "Code scanning takes no results for ref '$GITHUB_REF' — not reporting the version check."; exit 0 ;;
+        esac
+
+        # owner/repo/.github/workflows/ci.yml@refs/heads/main -> .github/workflows/ci.yml
+        WORKFLOW="${GITHUB_WORKFLOW_REF#"$GITHUB_REPOSITORY/"}"
+        WORKFLOW="${WORKFLOW%@*}"
+
+        RESULTS='[]'
+        if [ "$LATEST" != "$VERSION" ]; then
+          # The first line naming the version: in the workflow that runs this job, then in any
+          # other workflow of the repository (a reusable one, say). Failing that, the line that
+          # uses the action, then the top of the workflow.
+          FILE=""
+          LINE=""
+          PATTERN="(^|[^0-9.])${VERSION//./\\.}([^0-9.]|$)"
+          while IFS= read -r CANDIDATE; do
+            [ -f "$CANDIDATE" ] || continue
+            HIT=$(grep -nE -m1 "$PATTERN" "$CANDIDATE" | cut -d: -f1 || true)
+            if [ -n "$HIT" ]; then
+              FILE="$CANDIDATE"
+              LINE="$HIT"
+              break
+            fi
+          done < <(printf '%s\n' "$WORKFLOW"; find .github/workflows -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) 2>/dev/null | sort)
+          if [ -z "$FILE" ] && [ -f "$WORKFLOW" ]; then
+            FILE="$WORKFLOW"
+            LINE=$(grep -nE -m1 'uses:.*open-java-format-action' "$FILE" | cut -d: -f1 || true)
+            LINE="${LINE:-1}"
+          fi
+          if [ -z "$FILE" ]; then
+            echo "No workflow file to put the alert on — not reporting the version check."
+            exit 0
+          fi
+
+          # Code scanning tells alerts apart by this fingerprint, not by the line number. It is
+          # made from the line's text without whitespace, so the alert survives the line moving.
+          TEXT=$(sed -n "${LINE}p" "$FILE" | tr -d '\r')
+          FINGERPRINT=$(printf '%s' "${TEXT//[[:space:]]/}" | git hash-object --stdin)
+          RESULTS=$(jq -n \
+            --arg text "open-java-format $LATEST is available; this workflow checks formatting with $VERSION." \
+            --arg file "$FILE" --argjson line "$LINE" --argjson end "$(( ${#TEXT} + 1 ))" \
+            --arg fingerprint "${FINGERPRINT:0:16}:1" \
+            '[{
+              ruleId: "outdated-version",
+              level: "warning",
+              message: {text: $text},
+              locations: [{physicalLocation: {
+                artifactLocation: {uri: $file},
+                region: {startLine: $line, startColumn: 1, endLine: $line, endColumn: $end}
+              }}],
+              partialFingerprints: {primaryLocationLineHash: $fingerprint}
+            }]')
+        fi
+
+        HELP="$RUNNER_TEMP/open-java-format-version-help.md"
+        cat > "$HELP" <<'HELP_END'
+        A newer [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) is out than the one this workflow checks formatting with. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one.
+
+        To update:
+
+        - set the `version` input of `openjavaformat/open-java-format-action` to the new release;
+        - if the repository uses the pre-commit hook, set `FORMATTER_VERSION` at the top of it to the same release.
+
+        The alert closes on its own once the workflow runs with the latest release.
+        HELP_END
+
+        # One category per workflow and job, so that uploads from different jobs do not replace
+        # one another: open-java-format-action/ci.yml/format/
+        CATEGORY="open-java-format-action/${WORKFLOW:+${WORKFLOW##*/}/}${GITHUB_JOB:-job}/"
+        SARIF=$(jq -n --rawfile help "$HELP" --arg category "$CATEGORY" --argjson results "$RESULTS" '{
+          "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+          version: "2.1.0",
+          runs: [{
+            tool: {driver: {
+              name: "open-java-format-action",
+              informationUri: "https://github.com/openjavaformat/open-java-format-action",
+              rules: [{
+                id: "outdated-version",
+                name: "OutdatedVersion",
+                shortDescription: {text: "A newer open-java-format release is available"},
+                fullDescription: {text: "The workflow checks formatting with an open-java-format version older than the latest release. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one."},
+                help: {text: $help, markdown: $help},
+                defaultConfiguration: {level: "warning"},
+                properties: {tags: ["maintainability"], precision: "very-high", "problem.severity": "warning"}
+              }]
+            }},
+            automationDetails: {id: $category},
+            results: $results
+          }]
+        }')
+
+        RESPONSE="$RUNNER_TEMP/open-java-format-code-scanning-response.json"
+        STATUS=$(jq -n --arg sha "$GITHUB_SHA" --arg ref "$GITHUB_REF" \
+            --arg started "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            --arg sarif "$(printf '%s' "$SARIF" | gzip -c | base64 | tr -d '\n')" \
+            '{commit_sha: $sha, ref: $ref, started_at: $started, tool_name: "open-java-format-action", sarif: $sarif}' \
+          | curl -sS -o "$RESPONSE" -w '%{http_code}' -X POST \
+              -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" --data-binary @- \
+              "${GITHUB_API_URL:-https://api.github.com}/repos/$GITHUB_REPOSITORY/code-scanning/sarifs" \
+          || true)
+        STATUS="${STATUS:-000}"
+        case "$STATUS" in
+          202)
+            if [ "$RESULTS" = "[]" ]; then
+              echo "Reported to code scanning: open-java-format $VERSION is the latest release."
+            else
+              echo "Reported to code scanning: an alert on $FILE:$LINE, open-java-format $LATEST is available."
+            fi
+            ;;
+          403|404)
+            # No permission, no GitHub Code Security on a private repository, or the read-only
+            # token of a pull request from a fork. The log warning above stays.
+            echo "Code scanning did not accept the version check (HTTP $STATUS: $(jq -r '.message // empty' "$RESPONSE" 2>/dev/null)). To get it as a code scanning alert, give the job the 'security-events: write' permission; a private repository also needs GitHub Code Security. Set the code-scanning input to 'false' to stop these uploads."
+            ;;
+          *)
+            echo "::warning::Could not report the version check to code scanning (HTTP $STATUS): $(cat "$RESPONSE" 2>/dev/null)"
+            ;;
+        esac
+
     - name: Cache open-java-format binary
       id: cache
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
@@ -10,6 +10,10 @@ jobs:
   format-check:
     name: Check Java formatting
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # mode: changed reads the files of the pull request
+      security-events: write # the action reports its version check to code scanning
 
     steps:
       - uses: actions/checkout@v7