diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e36bc9c2b..05b50f024 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -79,13 +79,6 @@ jobs:
         run: |
           npm run check-types
 
-      - name: Lint
-        working-directory: extensions/ql-vscode
-        env:
-          NODE_OPTIONS: '--max-old-space-size=4096'
-        run: |
-          npm run lint
-
       - name: Lint Markdown
         working-directory: extensions/ql-vscode
         run: |
@@ -101,6 +94,20 @@ jobs:
         run: |
           npm run find-deadcode
 
+      - name: Lint
+        working-directory: extensions/ql-vscode
+        env:
+          NODE_OPTIONS: '--max-old-space-size=4096'
+        run: |
+          npm run lint-ci
+
+      - name: Upload ESLint results to Code Scanning
+        if: "${{ !cancelled() }}"
+        uses: github/codeql-action/upload-sarif@main
+        with:
+          sarif_file: extensions/ql-vscode/build/eslint.sarif
+          category: eslint
+
   generated:
     name: Check generated code
     runs-on: ubuntu-latest
diff --git a/extensions/ql-vscode/package-lock.json b/extensions/ql-vscode/package-lock.json
index e346e6eb3..7a9ca9b70 100644
--- a/extensions/ql-vscode/package-lock.json
+++ b/extensions/ql-vscode/package-lock.json
@@ -53,6 +53,7 @@
         "@babel/preset-typescript": "^7.21.4",
         "@faker-js/faker": "^8.4.1",
         "@github/markdownlint-github": "^0.6.2",
+        "@microsoft/eslint-formatter-sarif": "^3.1.0",
         "@playwright/test": "^1.40.1",
         "@storybook/addon-a11y": "^8.3.0",
         "@storybook/addon-actions": "^8.3.0",
@@ -3945,6 +3946,21 @@
       "integrity": "sha512-2IHAOaLauc8qaAitvWS+U931T+ze+7MNWrDHY47IENP5y2UA0vqJDu67kWZDdpCN1fFC77sfgfB+HV7SrKshnQ==",
       "dev": true
     },
+    "node_modules/@microsoft/eslint-formatter-sarif": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@microsoft/eslint-formatter-sarif/-/eslint-formatter-sarif-3.1.0.tgz",
+      "integrity": "sha512-/mn4UXziHzGXnKCg+r8HGgPy+w4RzpgdoqFuqaKOqUVBT5x2CygGefIrO4SusaY7t0C4gyIWMNu6YQT6Jw64Cw==",
+      "dev": true,
+      "dependencies": {
+        "eslint": "^8.9.0",
+        "jschardet": "latest",
+        "lodash": "^4.17.14",
+        "utf8": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/@microsoft/fast-element": {
       "version": "1.12.0",
       "resolved": "https://registry.npmjs.org/@microsoft/fast-element/-/fast-element-1.12.0.tgz",
@@ -17190,6 +17206,15 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/jschardet": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/jschardet/-/jschardet-3.1.3.tgz",
+      "integrity": "sha512-Q1PKVMK/uu+yjdlobgWIYkUOCR1SqUmW9m/eUJNNj4zI2N12i25v8fYpVf+zCakQeaTdBdhnZTFbVIAVZIVVOg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.1.90"
+      }
+    },
     "node_modules/jsdom": {
       "version": "20.0.3",
       "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-20.0.3.tgz",
@@ -23224,6 +23249,12 @@
         "requires-port": "^1.0.0"
       }
     },
+    "node_modules/utf8": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/utf8/-/utf8-3.0.0.tgz",
+      "integrity": "sha512-E8VjFIQ/TyQgp+TZfS6l8yp/xWppSAHzidGiRrqe4bK4XP9pTRyKFgGJpO3SN7zdX4DeomTrwaseCHovfpFcqQ==",
+      "dev": true
+    },
     "node_modules/util": {
       "version": "0.12.5",
       "resolved": "https://registry.npmjs.org/util/-/util-0.12.5.tgz",
diff --git a/extensions/ql-vscode/package.json b/extensions/ql-vscode/package.json
index c53206336..b7766103d 100644
--- a/extensions/ql-vscode/package.json
+++ b/extensions/ql-vscode/package.json
@@ -1953,6 +1953,7 @@
     "update-vscode": "node ./node_modules/vscode/bin/install",
     "format": "prettier --write **/*.{ts,tsx} && eslint . --ext .ts,.tsx --fix",
     "lint": "eslint . --ext .js,.ts,.tsx --max-warnings=0",
+    "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint . --ext .js,.ts,.tsx --max-warnings=0 --format @microsoft/eslint-formatter-sarif --output-file=build/eslint.sarif",
     "lint:markdown": "markdownlint-cli2 \"../../**/*.{md,mdx}\" \"!**/node_modules/**\" \"!**/.vscode-test/**\" \"!**/build/cli/v*/**\"",
     "find-deadcode": "vite-node scripts/find-deadcode.ts",
     "format-staged": "lint-staged",
@@ -2010,6 +2011,7 @@
     "@babel/preset-typescript": "^7.21.4",
     "@faker-js/faker": "^8.4.1",
     "@github/markdownlint-github": "^0.6.2",
+    "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@playwright/test": "^1.40.1",
     "@storybook/addon-a11y": "^8.3.0",
     "@storybook/addon-actions": "^8.3.0",