Fix `upload-sarif` Action failing if there are no Code Scanning SARIF files by mbg · Pull Request #3123 · github/codeql-action · GitHub

In #3064, we overlooked that upload_lib.uploadFiles is called in the upload-sarif Action, which will fail if it cannot find any SARIF files matching the predicate it is given.

For a Code Quality only analysis, there are no Code Scanning SARIF files and the call to upload_lib.uploadFiles therefore fails before the Code Quality SARIF file(s) can be uploaded.

This PR refactors the upload-sarif Action so that there's common code for Code Scanning and Code Quality to upload either one file or several matching files.

There are some optional, other changes in this PR as well, which I can remove if needed:

The UploadStatusReport values for each SARIF upload are now combined for telemetry if both analysis kinds are enabled. Otherwise, we use the respective UploadStatusReport.
I have added a new sarif-ids output to the upload-sarif Action, which contains a stringified JSON object with details of the SARIF ids that we uploaded to different endpoints. Initially I went for just a comma-separated list of IDs, but I thought it would be useful to know which ID is for which service.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

…s then

Pull Request Overview

This PR fixes an issue where the upload-sarif Action fails when there are no Code Scanning SARIF files, specifically for code quality-only analysis. It refactors the upload process to handle both Code Scanning and Code Quality SARIF files more gracefully and adds new outputs for tracking uploaded SARIF IDs.

Refactors upload logic to use a common findAndUpload function for both analysis types
Adds new sarif-ids output containing a JSON object with SARIF IDs for each analysis type
Combines upload status reports when both analysis kinds are enabled
Updates test configuration to test code quality-only scenarios

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
upload-sarif/action.yml	Updates output descriptions and adds new sarif-ids output
src/upload-sarif-action.ts	Refactors upload logic with new findAndUpload function and combined status reporting
src/upload-lib.ts	Adds combineSarifUploadResults function to merge upload status reports
pr-checks/checks/upload-quality-sarif.yml	Updates test to use code-quality only and validates new output
lib/upload-sarif-action.js	Generated JavaScript code reflecting TypeScript changes
lib/upload-lib.js	Generated JavaScript code with new export for combine function
.github/workflows/__upload-quality-sarif.yml	Auto-generated workflow file updated for code-quality only testing

Can you motivate the Disable cpp in upload-quality-sarif check commit?

Is it convention to add the empty object to these statuses by default?

Note that this was an intermediate commit and the {} just made the type checker happy until I replaced it with the statusReport from the Code Quality upload or the combination of both uploads.

The three properties of UploadStatusReport are all of type number | undefined, but the UploadStatusReport object itself is required here by sendSuccessStatusReport.

Previously, with only Code Scanning, we only would have reached sendSuccessStatusReport if the SARIF upload to Code Scanning is successful. In that case, the UploadStatusReport object always would have been populated.

Now we also have Code Quality and Code Scanning + Code Quality. So the status report should include the results of the respective upload(s).

This is too ad hoc for my taste. Once we add a new numeric field to the type, it will get dropped when going through this function

I.e. something like

  for (const report of reports) {
    if (!report) continue;
    for (const key of Object.keys(report) as (keyof UploadStatusReport)[]) {
      const value = report[key];
      if (typeof value !== "number") continue; // Skip non-numeric / undefined
      result[key] = ((result[key] ?? 0) as number) + value;
    }
  }

Conversely, we now risk adding things that can't be added...

Ultimately, we could do some typescript magic where we'd force ourselves to list every numerically typed property as being added or ignored, but that is complex.

We could do something like that. Perhaps it is best if we leave sorting out the telemetry for a separate change so that we can think about this independently from the bug fix -- see my thoughts in the PR description and in #3123 (comment)

Can you motivate the Disable cpp in upload-quality-sarif check commit?

@esbena C++ has no queries in the code-quality suite and the CLI fails as a result. See https://github.com/github/codeql-action/actions/runs/17831231939/job/50696560032?pr=3123#step:5:892

Perhaps it is best if we leave sorting out the telemetry for a separate change so that we can think about this independently from the bug fix

OK and conditional approve if we do that change elsewhere.

Unlike `sarif-id` which is for the single Code Scanning SARIF id, `sarif-ids` contains stringified JSON object with details of all SARIF ids.

I've removed the telemetry changes, other than that in the CQ-only case we send an empty UploadStatusReport. I think that's better than setting the fields to 0 since it allows us to tell apart status reports for CS/CS+CQ that have the data for CS from those that are for CQ-only and have no data.

mbg added 2 commits September 18, 2025 14:13

Refactor CQ SARIF upload in upload-sarif into a function

35454d3

Call lstatSync on sarifPath earlier and check that the path exist…

a6161a8

…s then

mbg requested a review from a team as a code owner September 18, 2025 13:58

mbg requested review from Copilot and henrymercer September 18, 2025 13:58

Copilot AI reviewed Sep 18, 2025

View reviewed changes

Comment thread pr-checks/checks/upload-quality-sarif.yml Outdated

Comment thread .github/workflows/__upload-quality-sarif.yml Outdated

mbg force-pushed the mbg/fix/upload-sarif-cq-only branch from 00415e9 to 79b45c8 Compare September 18, 2025 14:03

mbg commented Sep 18, 2025

View reviewed changes

Comment thread src/upload-sarif-action.ts Outdated

mbg added 3 commits September 18, 2025 16:28

Move isDirectory check into findAndUpload

c8e017d

Handle single file case in findAndUpload

696b467

Use findAndUpload for Code Scanning

a2ce099

mbg force-pushed the mbg/fix/upload-sarif-cq-only branch from 6d2c7db to bca5bc4 Compare September 18, 2025 15:29

esbena reviewed Sep 19, 2025

View reviewed changes

esbena previously approved these changes Sep 19, 2025

View reviewed changes

mbg added 5 commits September 19, 2025 16:17

Add new sarif-ids output to upload-sarif action

d378195

Unlike `sarif-id` which is for the single Code Scanning SARIF id, `sarif-ids` contains stringified JSON object with details of all SARIF ids.

Fix outdated comment

7bea0e2

Update upload-quality-sarif check to only use code-quality

e33b0ab

Disable cpp in upload-quality-sarif check

6249793

Fix condition

db37d92

mbg dismissed esbena’s stale review via db37d92 September 19, 2025 15:17

mbg force-pushed the mbg/fix/upload-sarif-cq-only branch from bca5bc4 to db37d92 Compare September 19, 2025 15:17

mbg requested a review from esbena September 19, 2025 15:22

esbena approved these changes Sep 19, 2025

View reviewed changes

mbg merged commit 0337c4c into main Sep 19, 2025
299 checks passed

mbg deleted the mbg/fix/upload-sarif-cq-only branch September 19, 2025 17:48

github-actions Bot mentioned this pull request Sep 25, 2025

Merge main into releases/v3 #3149

Merged

8 tasks

This was referenced Sep 25, 2025

Fix upload-sarif not uploading non-.sarif files #3157

Closed

Add tests for upload-sarif #3166

Merged

coderabbitai Bot mentioned this pull request Apr 3, 2026

chore: integrate Detekt for static code analysis and add configuration files twangodev/jetplay#12

Merged

This was referenced Apr 12, 2026

fix(snyk): Update action and split report upload Accenture/AutoFixture.XUnit2.AutoMock#318

Merged

feat: switch code quality setup to ultracite and biome ahmadk953/poixpixel-discord-bot#769

Merged

This was referenced May 19, 2026

Add Trivy security scanning workflow (weekly + manual) ggfevans/zed-hujson#7

Merged

feat: add initial GitHub Action wrapping skill-linter aipcc-cicd/skill-linter-action#1

Merged

coderabbitai Bot mentioned this pull request Aug 13, 2026

ci: scan pull requests for credentials and injection with ThreatCrush chrisleekr/binance-trading-bot#732

Closed

-                  await sendSuccessStatusReport(startedAt, uploadResult.statusReport, logger);
+                  await sendSuccessStatusReport(
+                    startedAt,
+                    uploadResult?.statusReport || {},

+                for (const report of reports) {
+                  if (report !== undefined) {
+                    result.num_results_in_sarif = addOptional(
+                      result.num_results_in_sarif,
+                      report.num_results_in_sarif,
+                    );
+                    result.raw_upload_size_bytes = addOptional(
+                      result.raw_upload_size_bytes,
+                      report.raw_upload_size_bytes,
+                    );
+                    result.zipped_upload_size_bytes = addOptional(
+                      result.zipped_upload_size_bytes,
+                      report.zipped_upload_size_bytes,
+                    );
+                  }
+                }

Fix `upload-sarif` Action failing if there are no Code Scanning SARIF files by mbg · Pull Request #3123 · github/codeql-action · GitHub

Uh oh!

Fix upload-sarif Action failing if there are no Code Scanning SARIF files - #3123

Fix upload-sarif Action failing if there are no Code Scanning SARIF files#3123
mbg merged 10 commits into
mainfrom
mbg/fix/upload-sarif-cq-only

mbg commented Sep 18, 2025 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

esbena left a comment

Uh oh!

esbena Sep 19, 2025

Uh oh!

mbg Sep 19, 2025

Uh oh!

esbena Sep 19, 2025

Uh oh!

esbena Sep 19, 2025

Uh oh!

mbg Sep 19, 2025

Uh oh!

mbg commented Sep 19, 2025

Uh oh!

esbena left a comment

Uh oh!

mbg commented Sep 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix `upload-sarif` Action failing if there are no Code Scanning SARIF files by mbg · Pull Request #3123 · github/codeql-action · GitHub

Uh oh!

Fix upload-sarif Action failing if there are no Code Scanning SARIF files - #3123

Fix upload-sarif Action failing if there are no Code Scanning SARIF files#3123mbg merged 10 commits intomaingithub/codeql-action:mainfrom mbg/fix/upload-sarif-cq-onlygithub/codeql-action:mbg/fix/upload-sarif-cq-onlyCopy head branch name to clipboard

Conversation

mbg commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

esbena left a comment

Choose a reason for hiding this comment

Uh oh!

esbena Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

mbg Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

esbena Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

esbena Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

mbg Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

mbg commented Sep 19, 2025

Uh oh!

esbena left a comment

Choose a reason for hiding this comment

Uh oh!

mbg commented Sep 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix upload-sarif Action failing if there are no Code Scanning SARIF files#3123
mbg merged 10 commits into
mainfrom
mbg/fix/upload-sarif-cq-only

mbg commented Sep 18, 2025 •
edited
Loading