Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix failed SARIF upload behavior when the workflow doesn't call the CodeQL Action #1420

Merged
merged 5 commits into from
Dec 7, 2022

Conversation

henrymercer
Copy link
Contributor

We encountered some unexpected behavior with a workflow that called codeql-action/analyze locally. The workflow parsing code couldn't resolve the local call to the CodeQL Action, and erroneously returned the default values of each input. This meant that we uploaded a failed SARIF file when we shouldn't have.

This PR adds a regression test for this case, and changes the workflow parsing code to be more conservative. Now we only upload a failed SARIF file when the current job calls the relevant Action exactly once in the workflow file.

No changelog needed since this functionality hasn't been rolled out yet.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Confirm the readme has been updated if necessary.
  • Confirm the changelog has been updated if necessary.

This created unexpected behavior with a workflow calling
`codeql-action/analyze` locally.
Therefore, be more conservative with parsing inputs from workflows and
refuse to parse jobs that don't call the specified Action exactly once.
This isn't severe enough to appear on the Actions summary.
@henrymercer henrymercer requested a review from a team as a code owner December 6, 2022 18:18
@henrymercer henrymercer merged commit 79166d0 into main Dec 7, 2022
@henrymercer henrymercer deleted the henrymercer/failed-runs-fix-action-not-found branch December 7, 2022 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants