-
Notifications
You must be signed in to change notification settings - Fork 309
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
upload-sarif@v1 : master does not match /^refs\/(heads|pull|tags)\/.*$/. #796
Comments
The ref that the upload action passes is grabbed from the You mentioned that you are using a composite action. It's unlikely, but it's possible that the environment variable is getting mangled there? Something like this would work: Can you try something for me? Before the
If my guess is right, then we should figure out why the variable is being mangled. But as a quick workaround, you could explicitly set the variable to prepend the |
Thanks for your quick reply. Indeed you are right, it seems that the GITHUB_REF is not populated correctly in some case with the composite action. Workflow triggered manually on master branch :
However when the same workflow is triggered by a PR closed from develop to master, I get :
Here the So do you think "something" in the composite action change the value of the In my use-case, this workflow could be either triggered by a PR or manually. I'll add a step to check and explicity set the |
Hi @totogtr and @aeisenberg I'm facing the same issue. Were you able to explicitly set the |
EDIT: This will not work. GitHub Actions refuses to allow you to edit any env variable prefixed with |
@totogtr would you be able to share the full Actions workflow file, so that we can see the different events your workflow is running on? And also the full contents of your composite action if possible. |
@adityasharad Hi, sorry I cannot share the full action, some as client data in it. I've just hit this issue again today (1st time since my last message !) Is there anything in #889 that would help us fix it? |
Yes, the upload-sarif action now supports a - uses: github/codeql-action/upload-sarif@v1
with:
ref: '${{ ref }}'
sha: '${{ sha }}' You need to specify both of them together. |
Sometimes GitHub Actions uses bare branch name whereas CodeQL always expects ref. See github/codeql-action#796 PiperOrigin-RevId: 549548061
Sometimes GitHub Actions uses bare branch name whereas CodeQL always expects ref. See github/codeql-action#796 PiperOrigin-RevId: 549548061
Sometimes GitHub Actions uses bare branch name whereas CodeQL always expects ref. See github/codeql-action#796 PiperOrigin-RevId: 549548061
Sometimes GitHub Actions uses bare branch name whereas CodeQL always expects ref. See github/codeql-action#796 PiperOrigin-RevId: 550504283
Hi,
I'm facing an issue uploading a SARIF file using upload-sarif@v1 on a self-hosted runner.
Here is my code (in a composite action) :
This works great when I push / PR to a branch called
develop
but an issue is happening when I apply the same composite action tomaster
branch. It looks like for some reason the upload-sarif@v1 action doesn't call the API correctly ?Here are the logs on develop (omitting env variables) :
I can see the uploaded results on the security tab of the github repo.
Here are the logs on master:
The API doc mention that ref is
Required. The full Git reference, formatted as refs/heads/<branch name>,refs/pull/<number>/merge, or refs/pull/<number>/head.
: https://docs.github.com/en/rest/reference/code-scanning#upload-an-analysis-as-sarif-dataUsing this action we have no control other what the action sends to the API so it is not possible in our end to enforce the full git reference.
Is this a known issue ? Any reason why I am facing here in a
master
branch but not on other branches ?The text was updated successfully, but these errors were encountered: