-
Notifications
You must be signed in to change notification settings - Fork 5.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Scorecards.yml: do not upload the result in the security dashboard if it is a pull request #1820
Comments
This feels more of an issue with codeql action |
Does this problem also occurs with v2? That template has older version |
I've tested using codeql-action 2.1.31 and I've got the same error https://github.com/joycebrum/SQLGame/actions/runs/3489036386/jobs/5838617362 Seems to be really related to the issues but it does not seemed solved. |
Yeah not solved yet. I feel adding an optional tigger on condition and having an optional condition to run when triggered in pull request does seem correct. And this would be failing for all the code-scanning template. |
Does "results.sarif" not exist for that case? |
Actually we don't have a published sarif in scorecard action (see https://github.com/ossf/scorecard-action/pull/935/files) when running on pull request, because |
I guess |
I've testes using |
Yes, for |
|
I feel it is by design of scorecard action. Right @laurentsimon? |
@Phantsure I think the only action item we could do here is the one I suggested in the PR (#1821) to avoid the upload if it is a PR, which seemed to be enough to fix the run on the test cases I've tested (like systemd) |
@joycebrum Can you file an issue on scorecard-action? It seems like in your run, the sarif file only contains:
In a test PR I sent https://github.com/ossf/scorecard/actions/runs/3561057797/jobs/5981621304, you can see the SARIF contained information. Maybe that is where the problem comes from, given that empty SARIF files seem to trigger github/codeql-action#390 Enabling SARIF on pull requests lets users see which lines are changing the scorecard results, so it'd be nice to keep it. |
Sure, I'll do it. |
@laurentsimon Do you also want this change in starter workflow or want to keep track in new issue here created by @joycebrum ? |
Let's close this issue and find out what's going on in scorecard. This may be a bug there. We'll re-open here if needed. @joycebrum ok with this? |
Sure, it makes sense. Thanks for the support @Phantsure and @laurentsimon |
When the action is configured to run in pull request, although it do not try to publish results (since 2.0.4), it tries to upload the results to Github's code scanning dashboard and returns an error (https://github.com/systemd/systemd/actions/runs/3276042271/jobs/5391618343).
I've manually disable it using the following configuration:
I think the best solution is to avoid uploading the results to the security dashboard if it is a pull request, what do you think? I can suggest the PR with the changes if so.
The text was updated successfully, but these errors were encountered: