Upload failed SARIF as workflow artifact in test mode

lib/entry-points.js

@@ -178525,6 +178525,7 @@ __export(upload_lib_exports, {
   filterAlertsByDiffRange: () => filterAlertsByDiffRange,
   findSarifFilesInDir: () => findSarifFilesInDir,
   getGroupedSarifFilePaths: () => getGroupedSarifFilePaths,
+  getSavedPayloadPath: () => getSavedPayloadPath,
   populateRunAutomationDetails: () => populateRunAutomationDetails,
   postProcessSarifFiles: () => postProcessSarifFiles,
   readSarifFileOrThrow: () => readSarifFileOrThrow,
@@ -180088,13 +180089,16 @@ function getAutomationID2(category, analysis_key, environment) {
   }
   return computeAutomationID(analysis_key, environment);
 }
+function getSavedPayloadPath(analysisKind) {
+  return path19.join(
+    getTemporaryDirectory(),
+    `payload-${analysisKind}.json`
+  );
+}
 async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
   logger2.info("Uploading results");
   if (shouldSkipSarifUpload()) {
-    const payloadSaveFile = path19.join(
-      getTemporaryDirectory(),
-      `payload-${analysis.kind}.json`
-    );
+    const payloadSaveFile = getSavedPayloadPath(analysis.kind);
     logger2.info(
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
     );
@@ -186971,6 +186975,14 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger2)
     logger2,
     { isUnsuccessfulExecution: true }
   );
+  if (uploadResult.sarifID && isInTestMode()) {
+    await uploadSarifArtifact(logger2, "test-mode-sarif", {
+      // We defaulted to CodeScanning in the `uploadFiles` call above.
+      sarifFile: getSavedPayloadPath(CodeScanning.kind),
+      category: failedSarif.category,
+      checkoutPath: failedSarif.checkoutPath
+    });
+  }
   return uploadResult ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID } : {};
 }
 async function maybeUploadFailedSarifArtifact(config, features, logger2) {
@@ -186979,13 +186991,16 @@ async function maybeUploadFailedSarifArtifact(config, features, logger2) {
     return failedSarifResult.value;
   }
   const failedSarif = failedSarifResult.value;
+  return uploadSarifArtifact(logger2, "sarif-artifact", failedSarif);
+}
+async function uploadSarifArtifact(logger2, prefix, failedSarif) {
   logger2.info(
     `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`
   );
   const gitHubVersion = await getGitHubVersion();
   const client = await getArtifactUploaderClient(logger2, gitHubVersion.type);
   const suffix = getArtifactSuffix(getOptionalInput("matrix"));
-  const name = sanitizeArtifactName(`sarif-artifact-${suffix}`);
+  const name = sanitizeArtifactName(`${prefix}-${suffix}`);
   await client.uploadArtifact(
     name,
     [import_path8.default.normalize(failedSarif.sarifFile)],

src/init-action-post-helper.ts

@@ -25,7 +25,7 @@ import {
 } from "./debug-artifacts";
 import * as dependencyCaching from "./dependency-caching";
 import { getTempDiagnosticPath } from "./diagnostics";
-import { EnvVar, ReadOnlyEnv } from "./environment";
+import { EnvVar, isInTestMode, ReadOnlyEnv } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -253,6 +253,19 @@ async function maybeUploadFailedSarif(
     logger,
     { isUnsuccessfulExecution: true },
   );
+
+  // If we are in test mode, `uploadFiles` will not have uploaded the failed SARIF file
+  // and instead will have written it to disk. Upload it as a workflow artifact so that
+  // we can inspect it in validation jobs.
+  if (uploadResult.sarifID && isInTestMode()) {
+    await uploadSarifArtifact(logger, "test-mode-sarif", {
+      // We defaulted to CodeScanning in the `uploadFiles` call above.
+      sarifFile: uploadLib.getSavedPayloadPath(CodeScanning.kind),
+      category: failedSarif.category,
+      checkoutPath: failedSarif.checkoutPath,
+    });
+  }
+
   return uploadResult
     ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID }
     : {};
@@ -271,7 +284,15 @@ async function maybeUploadFailedSarifArtifact(
   }
 
   const failedSarif = failedSarifResult.value;
+  return uploadSarifArtifact(logger, "sarif-artifact", failedSarif);
+}
 
+/** Uploads a failed SARIF file as workflow artifact. */
+async function uploadSarifArtifact(
+  logger: Logger,
+  prefix: string,
+  failedSarif: FailedSarifInfo,
+): Promise<UploadFailedSarifResult> {
   logger.info(
     `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`,
   );
@@ -280,7 +301,7 @@ async function maybeUploadFailedSarifArtifact(
   const client = await getArtifactUploaderClient(logger, gitHubVersion.type);
 
   const suffix = getArtifactSuffix(actionsUtil.getOptionalInput("matrix"));
-  const name = sanitizeArtifactName(`sarif-artifact-${suffix}`);
+  const name = sanitizeArtifactName(`${prefix}-${suffix}`);
   await client.uploadArtifact(
     name,
     [path.normalize(failedSarif.sarifFile)],

src/upload-lib.ts

@@ -227,6 +227,14 @@ function getAutomationID(
   return api.computeAutomationID(analysis_key, environment);
 }
 
+/** Gets the path to a saved payload file for {@link analysisKind}. */
+export function getSavedPayloadPath(analysisKind: analyses.AnalysisKind) {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(),
+    `payload-${analysisKind}.json`,
+  );
+}
+
 /**
  * Upload the given payload.
  * If the request fails then this will retry a small number of times.
@@ -241,10 +249,7 @@ export async function uploadPayload(
   logger.info("Uploading results");
 
   if (util.shouldSkipSarifUpload()) {
-    const payloadSaveFile = path.join(
-      actionsUtil.getTemporaryDirectory(),
-      `payload-${analysis.kind}.json`,
-    );
+    const payloadSaveFile = getSavedPayloadPath(analysis.kind);
     logger.info(
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`,
     );