From 850cc877c3a1f39aa94dd950d6bebcd4b0c0f27a Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 12 Oct 2026 17:23:44 +0100
Subject: [PATCH] Upload failed SARIF as workflow artifact in test mode

---
 lib/entry-points.js            | 20 +++++++++++++++-----
 src/init-action-post-helper.ts | 19 ++++++++++++++++++-
 src/upload-lib.ts              | 13 +++++++++----
 3 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index ea4f7c9be..05694644e 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -178546,6 +178546,7 @@ __export(upload_lib_exports, {
   filterAlertsByDiffRange: () => filterAlertsByDiffRange,
   findSarifFilesInDir: () => findSarifFilesInDir,
   getGroupedSarifFilePaths: () => getGroupedSarifFilePaths,
+  getSavedPayloadPath: () => getSavedPayloadPath,
   populateRunAutomationDetails: () => populateRunAutomationDetails,
   postProcessSarifFiles: () => postProcessSarifFiles,
   readSarifFileOrThrow: () => readSarifFileOrThrow,
@@ -180108,13 +180109,16 @@ function getAutomationID2(category, analysis_key, environment) {
   }
   return computeAutomationID(analysis_key, environment);
 }
+function getSavedPayloadPath(analysisKind) {
+  return path19.join(
+    getTemporaryDirectory(),
+    `payload-${analysisKind}.json`
+  );
+}
 async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
   logger2.info("Uploading results");
   if (shouldSkipSarifUpload()) {
-    const payloadSaveFile = path19.join(
-      getTemporaryDirectory(),
-      `payload-${analysis.kind}.json`
-    );
+    const payloadSaveFile = getSavedPayloadPath(analysis.kind);
     logger2.info(
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
     );
@@ -187005,6 +187009,9 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger2)
     logger2,
     { isUnsuccessfulExecution: true }
   );
+  if (uploadResult.sarifID && shouldSkipSarifUpload()) {
+    await uploadSarifArtifact(logger2, "test-mode-sarif", failedSarif);
+  }
   return uploadResult ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID } : {};
 }
 async function maybeUploadFailedSarifArtifact(config, features, logger2) {
@@ -187013,13 +187020,16 @@ async function maybeUploadFailedSarifArtifact(config, features, logger2) {
     return failedSarifResult.value;
   }
   const failedSarif = failedSarifResult.value;
+  return uploadSarifArtifact(logger2, "sarif-artifact", failedSarif);
+}
+async function uploadSarifArtifact(logger2, prefix, failedSarif) {
   logger2.info(
     `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`
   );
   const gitHubVersion = await getGitHubVersion();
   const client = await getArtifactUploaderClient(logger2, gitHubVersion.type);
   const suffix = getArtifactSuffix(getOptionalInput("matrix"));
-  const name = sanitizeArtifactName(`sarif-artifact-${suffix}`);
+  const name = sanitizeArtifactName(`${prefix}-${suffix}`);
   await client.uploadArtifact(
     name,
     [import_path8.default.normalize(failedSarif.sarifFile)],
diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts
index b7b4da8e5..0f0062ca7 100644
--- a/src/init-action-post-helper.ts
+++ b/src/init-action-post-helper.ts
@@ -45,6 +45,7 @@ import {
   parseMatrixInput,
   Result,
   shouldSkipGenerateFailedSarif,
+  shouldSkipSarifUpload,
   Success,
   wrapError,
 } from "./util";
@@ -240,6 +241,14 @@ async function maybeUploadFailedSarif(
     logger,
     { isUnsuccessfulExecution: true },
   );
+
+  // If SARIF upload is disabled for testing, `uploadFiles` will not have uploaded the failed
+  // SARIF file and instead will have written it to disk. Upload it as a workflow artifact so that
+  // we can inspect it in validation jobs.
+  if (uploadResult.sarifID && shouldSkipSarifUpload()) {
+    await uploadSarifArtifact(logger, "test-mode-sarif", failedSarif);
+  }
+
   return uploadResult
     ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID }
     : {};
@@ -258,7 +267,15 @@ async function maybeUploadFailedSarifArtifact(
   }
 
   const failedSarif = failedSarifResult.value;
+  return uploadSarifArtifact(logger, "sarif-artifact", failedSarif);
+}
 
+/** Uploads a failed SARIF file as workflow artifact. */
+async function uploadSarifArtifact(
+  logger: Logger,
+  prefix: string,
+  failedSarif: FailedSarifInfo,
+): Promise<UploadFailedSarifResult> {
   logger.info(
     `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`,
   );
@@ -267,7 +284,7 @@ async function maybeUploadFailedSarifArtifact(
   const client = await getArtifactUploaderClient(logger, gitHubVersion.type);
 
   const suffix = getArtifactSuffix(actionsUtil.getOptionalInput("matrix"));
-  const name = sanitizeArtifactName(`sarif-artifact-${suffix}`);
+  const name = sanitizeArtifactName(`${prefix}-${suffix}`);
   await client.uploadArtifact(
     name,
     [path.normalize(failedSarif.sarifFile)],
diff --git a/src/upload-lib.ts b/src/upload-lib.ts
index 7b0a17b30..b327054fb 100644
--- a/src/upload-lib.ts
+++ b/src/upload-lib.ts
@@ -231,6 +231,14 @@ function getAutomationID(
   return api.computeAutomationID(analysis_key, environment);
 }
 
+/** Gets the path to a saved payload file for {@link analysisKind}. */
+export function getSavedPayloadPath(analysisKind: analyses.AnalysisKind) {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(),
+    `payload-${analysisKind}.json`,
+  );
+}
+
 /**
  * Upload the given payload.
  * If the request fails then this will retry a small number of times.
@@ -245,10 +253,7 @@ export async function uploadPayload(
   logger.info("Uploading results");
 
   if (util.shouldSkipSarifUpload()) {
-    const payloadSaveFile = path.join(
-      actionsUtil.getTemporaryDirectory(),
-      `payload-${analysis.kind}.json`,
-    );
+    const payloadSaveFile = getSavedPayloadPath(analysis.kind);
     logger.info(
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`,
     );