fall back to GITHUB_SHA env var if git is not available

lib/util.js

@@ -140,15 +140,28 @@ exports.getLanguages = getLanguages;
  * Gets the SHA of the commit that is currently checked out.
  */
 async function getCommitOid() {
-    let commitOid = '';
-    await exec.exec('git', ['rev-parse', 'HEAD'], {
-        silent: true,
-        listeners: {
-            stdout: (data) => { commitOid += data.toString(); },
-            stderr: (data) => { process.stderr.write(data); }
-        }
-    });
-    return commitOid.trim();
+    // Try to use git to get the current commit SHA. If that fails then
+    // log but otherwise silently fall back to using the SHA from the environment.
+    // The only time these two values will differ is during analysis of a PR when
+    // the workflow has changed the current commit to the head commit instead of
+    // the merge commit, which must mean that git is available.
+    // Even if this does go wrong, it's not a huge problem for the alerts to
+    // reported on the merge commit.
+    try {
+        let commitOid = '';
+        await exec.exec('git', ['rev-parse', 'HEAD'], {
+            silent: true,
+            listeners: {
+                stdout: (data) => { commitOid += data.toString(); },
+                stderr: (data) => { process.stderr.write(data); }
+            }
+        });
+        return commitOid.trim();
+    }
+    catch (e) {
+        core.info("Failed to call git to get current commit. Continuing with data from environment: " + e);
+        return getRequiredEnvParam('GITHUB_SHA');
+    }
 }
 exports.getCommitOid = getCommitOid;
 /**

src/util.ts

@@ -139,15 +139,27 @@ export async function getLanguages(): Promise<string[]> {
  * Gets the SHA of the commit that is currently checked out.
  */
 export async function getCommitOid(): Promise<string> {
-  let commitOid = '';
-  await exec.exec('git', ['rev-parse', 'HEAD'], {
-    silent: true,
-    listeners: {
-      stdout: (data) => { commitOid += data.toString(); },
-      stderr: (data) => { process.stderr.write(data); }
-    }
-  });
-  return commitOid.trim();
+  // Try to use git to get the current commit SHA. If that fails then
+  // log but otherwise silently fall back to using the SHA from the environment.
+  // The only time these two values will differ is during analysis of a PR when
+  // the workflow has changed the current commit to the head commit instead of
+  // the merge commit, which must mean that git is available.
+  // Even if this does go wrong, it's not a huge problem for the alerts to
+  // reported on the merge commit.
+  try {
+    let commitOid = '';
+    await exec.exec('git', ['rev-parse', 'HEAD'], {
+      silent: true,
+      listeners: {
+        stdout: (data) => { commitOid += data.toString(); },
+        stderr: (data) => { process.stderr.write(data); }
+      }
+    });
+    return commitOid.trim();
+  } catch (e) {
+    core.info("Failed to call git to get current commit. Continuing with data from environment: " + e);
+    return getRequiredEnvParam('GITHUB_SHA');
+  }
 }
 
 /**