From 0570c2f5e9e709b341e09ab2618cda1be32a778f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 17:23:44 +0100 Subject: [PATCH] Upload failed SARIF as workflow artifact in test mode --- lib/entry-points.js | 25 ++++++++++++++++++++----- src/init-action-post-helper.ts | 25 +++++++++++++++++++++++-- src/upload-lib.ts | 13 +++++++++---- 3 files changed, 52 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 040571991..1a4d28840 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -178525,6 +178525,7 @@ __export(upload_lib_exports, { filterAlertsByDiffRange: () => filterAlertsByDiffRange, findSarifFilesInDir: () => findSarifFilesInDir, getGroupedSarifFilePaths: () => getGroupedSarifFilePaths, + getSavedPayloadPath: () => getSavedPayloadPath, populateRunAutomationDetails: () => populateRunAutomationDetails, postProcessSarifFiles: () => postProcessSarifFiles, readSarifFileOrThrow: () => readSarifFileOrThrow, @@ -180088,13 +180089,16 @@ function getAutomationID2(category, analysis_key, environment) { } return computeAutomationID(analysis_key, environment); } +function getSavedPayloadPath(analysisKind) { + return path19.join( + getTemporaryDirectory(), + `payload-${analysisKind}.json` + ); +} async function uploadPayload(payload, repositoryNwo, logger2, analysis) { logger2.info("Uploading results"); if (shouldSkipSarifUpload()) { - const payloadSaveFile = path19.join( - getTemporaryDirectory(), - `payload-${analysis.kind}.json` - ); + const payloadSaveFile = getSavedPayloadPath(analysis.kind); logger2.info( `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}` ); @@ -186971,6 +186975,14 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger2) logger2, { isUnsuccessfulExecution: true } ); + if (uploadResult.sarifID && isInTestMode()) { + await uploadSarifArtifact(logger2, "test-mode-sarif", { + // We defaulted to CodeScanning in the `uploadFiles` call above. + sarifFile: getSavedPayloadPath(CodeScanning.kind), + category: failedSarif.category, + checkoutPath: failedSarif.checkoutPath + }); + } return uploadResult ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID } : {}; } async function maybeUploadFailedSarifArtifact(config, features, logger2) { @@ -186979,13 +186991,16 @@ async function maybeUploadFailedSarifArtifact(config, features, logger2) { return failedSarifResult.value; } const failedSarif = failedSarifResult.value; + return uploadSarifArtifact(logger2, "sarif-artifact", failedSarif); +} +async function uploadSarifArtifact(logger2, prefix, failedSarif) { logger2.info( `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact` ); const gitHubVersion = await getGitHubVersion(); const client = await getArtifactUploaderClient(logger2, gitHubVersion.type); const suffix = getArtifactSuffix(getOptionalInput("matrix")); - const name = sanitizeArtifactName(`sarif-artifact-${suffix}`); + const name = sanitizeArtifactName(`${prefix}-${suffix}`); await client.uploadArtifact( name, [import_path8.default.normalize(failedSarif.sarifFile)], diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts index 4fd9bc049..46d7c77c4 100644 --- a/src/init-action-post-helper.ts +++ b/src/init-action-post-helper.ts @@ -25,7 +25,7 @@ import { } from "./debug-artifacts"; import * as dependencyCaching from "./dependency-caching"; import { getTempDiagnosticPath } from "./diagnostics"; -import { EnvVar, ReadOnlyEnv } from "./environment"; +import { EnvVar, isInTestMode, ReadOnlyEnv } from "./environment"; import { Feature, FeatureEnablement } from "./feature-flags"; import { Logger } from "./logging"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; @@ -253,6 +253,19 @@ async function maybeUploadFailedSarif( logger, { isUnsuccessfulExecution: true }, ); + + // If we are in test mode, `uploadFiles` will not have uploaded the failed SARIF file + // and instead will have written it to disk. Upload it as a workflow artifact so that + // we can inspect it in validation jobs. + if (uploadResult.sarifID && isInTestMode()) { + await uploadSarifArtifact(logger, "test-mode-sarif", { + // We defaulted to CodeScanning in the `uploadFiles` call above. + sarifFile: uploadLib.getSavedPayloadPath(CodeScanning.kind), + category: failedSarif.category, + checkoutPath: failedSarif.checkoutPath, + }); + } + return uploadResult ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID } : {}; @@ -271,7 +284,15 @@ async function maybeUploadFailedSarifArtifact( } const failedSarif = failedSarifResult.value; + return uploadSarifArtifact(logger, "sarif-artifact", failedSarif); +} +/** Uploads a failed SARIF file as workflow artifact. */ +async function uploadSarifArtifact( + logger: Logger, + prefix: string, + failedSarif: FailedSarifInfo, +): Promise { logger.info( `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`, ); @@ -280,7 +301,7 @@ async function maybeUploadFailedSarifArtifact( const client = await getArtifactUploaderClient(logger, gitHubVersion.type); const suffix = getArtifactSuffix(actionsUtil.getOptionalInput("matrix")); - const name = sanitizeArtifactName(`sarif-artifact-${suffix}`); + const name = sanitizeArtifactName(`${prefix}-${suffix}`); await client.uploadArtifact( name, [path.normalize(failedSarif.sarifFile)], diff --git a/src/upload-lib.ts b/src/upload-lib.ts index 9792e0225..23b7b91ef 100644 --- a/src/upload-lib.ts +++ b/src/upload-lib.ts @@ -227,6 +227,14 @@ function getAutomationID( return api.computeAutomationID(analysis_key, environment); } +/** Gets the path to a saved payload file for {@link analysisKind}. */ +export function getSavedPayloadPath(analysisKind: analyses.AnalysisKind) { + return path.join( + actionsUtil.getTemporaryDirectory(), + `payload-${analysisKind}.json`, + ); +} + /** * Upload the given payload. * If the request fails then this will retry a small number of times. @@ -241,10 +249,7 @@ export async function uploadPayload( logger.info("Uploading results"); if (util.shouldSkipSarifUpload()) { - const payloadSaveFile = path.join( - actionsUtil.getTemporaryDirectory(), - `payload-${analysis.kind}.json`, - ); + const payloadSaveFile = getSavedPayloadPath(analysis.kind); logger.info( `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`, );