Make an all-in-one action

A more easy to use action that runs the 'init' step as
a 'pre' script and the 'analyze' step as the 'main' script.

README.md

@@ -2,12 +2,6 @@
 
 This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/semmle/ql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
 
-## License
-
-This project is released under the [MIT License](LICENSE).
-
-The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on  private repositories that are owned by an organisation with GitHub Advanced Security enabled.
-
 ## Usage
 
 To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
@@ -168,3 +162,7 @@ dotnet build /p:UseSharedCompilation=false
 ```
 
 Version 3 does not require the additional flag.
+
+## License
+
+This project is released under the [MIT License](LICENSE).

action.yml

@@ -0,0 +1,32 @@
+name: 'CodeQL'
+description: 'CodeQL analysis'
+author: 'GitHub'
+inputs:
+  tools:
+    description: URL of CodeQL tools
+    required: false
+    default: https://github.com/github/codeql-action/releases/download/codeql-bundle-20200427/codeql-bundle.tar.gz
+  languages:
+    description: The languages to be analysed
+    required: false
+  token:
+    default: ${{ github.token }}
+  config-file:
+    description: Path of the config file to use
+    required: false
+  check_name:
+    description: The name of the check run to add text to.
+  output:
+    description: The path of the directory in which to save the SARIF results
+    required: false
+    default: '../results'
+  upload:
+    description: Upload the SARIF file
+    required: false
+    default: true
+  matrix:
+    default: ${{ toJson(matrix) }}
+runs:
+  using: 'node12'
+  pre: './lib/setup-tracer.js'
+  main: './lib/finalize-db.js'

lib/autobuild.js

@@ -22,16 +22,12 @@ async function run() {
         // We want pick the dominant language in the repo from the ones we're able to build
         // The languages are sorted in order specified by user or by lines of code if we got
         // them from the GitHub API, so try to build the first language on the list.
-        const autobuildLanguages = ((_a = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]) === null || _a === void 0 ? void 0 : _a.split(',')) || [];
-        const language = autobuildLanguages[0];
+        const language = (_a = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]) === null || _a === void 0 ? void 0 : _a.split(',')[0];
         if (!language) {
             core.info("None of the languages in this project require extra build steps");
             return;
         }
         core.debug(`Detected dominant traced language: ${language}`);
-        if (autobuildLanguages.length > 1) {
-            core.warning(`We will only automatically build ${language} code. If you wish to scan ${autobuildLanguages.slice(1).join(' and ')}, you must replace this block with custom build steps.`);
-        }
         core.startGroup(`Attempting to automatically build ${language} code`);
         // TODO: share config accross actions better via env variables
         const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
@@ -48,13 +44,13 @@ async function run() {
         core.endGroup();
     }
     catch (error) {
-        core.setFailed("We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps.  " + error.message);
+        core.setFailed(error.message);
         await util.reportActionFailed('autobuild', error.message, error.stack);
         return;
     }
     await util.reportActionSucceeded('autobuild');
 }
 run().catch(e => {
-    core.setFailed("autobuild action failed.  " + e);
+    core.setFailed("autobuild action failed: " + e);
     console.log(e);
 });

lib/config-utils.js

@@ -71,36 +71,41 @@ function initConfig() {
         core.debug('No configuration file was provided');
         return config;
     }
-    const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
-    if (parsedYAML.name && typeof parsedYAML.name === "string") {
-        config.name = parsedYAML.name;
+    try {
+        const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
+        if (parsedYAML.name && typeof parsedYAML.name === "string") {
+            config.name = parsedYAML.name;
+        }
+        if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
+            config.disableDefaultQueries = parsedYAML['disable-default-queries'];
+        }
+        const queries = parsedYAML.queries;
+        if (queries && queries instanceof Array) {
+            queries.forEach(query => {
+                if (query.uses && typeof query.uses === "string") {
+                    config.addQuery(query.uses);
+                }
+            });
+        }
+        const pathsIgnore = parsedYAML['paths-ignore'];
+        if (pathsIgnore && pathsIgnore instanceof Array) {
+            pathsIgnore.forEach(path => {
+                if (typeof path === "string") {
+                    config.pathsIgnore.push(path);
+                }
+            });
+        }
+        const paths = parsedYAML.paths;
+        if (paths && paths instanceof Array) {
+            paths.forEach(path => {
+                if (typeof path === "string") {
+                    config.paths.push(path);
+                }
+            });
+        }
     }
-    if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
-        config.disableDefaultQueries = parsedYAML['disable-default-queries'];
-    }
-    const queries = parsedYAML.queries;
-    if (queries && queries instanceof Array) {
-        queries.forEach(query => {
-            if (query.uses && typeof query.uses === "string") {
-                config.addQuery(query.uses);
-            }
-        });
-    }
-    const pathsIgnore = parsedYAML['paths-ignore'];
-    if (pathsIgnore && pathsIgnore instanceof Array) {
-        pathsIgnore.forEach(path => {
-            if (typeof path === "string") {
-                config.pathsIgnore.push(path);
-            }
-        });
-    }
-    const paths = parsedYAML.paths;
-    if (paths && paths instanceof Array) {
-        paths.forEach(path => {
-            if (typeof path === "string") {
-                config.paths.push(path);
-            }
-        });
+    catch (err) {
+        core.setFailed(err);
     }
     return config;
 }

lib/finalize-db.js

@@ -125,10 +125,7 @@ async function run() {
         core.info('Analyzing database');
         await runQueries(codeqlCmd, databaseFolder, sarifFolder, config);
         if ('true' === core.getInput('upload')) {
-            if (!await upload_lib.upload(sarifFolder)) {
-                await util.reportActionFailed('finish', 'upload');
-                return;
-            }
+            await upload_lib.upload(sarifFolder);
         }
     }
     catch (error) {

lib/setup-tracer.js

@@ -205,8 +205,8 @@ async function run() {
         await util.reportActionFailed('init', error.message, error.stack);
         return;
     }
-    await util.reportActionSucceeded('init');
     core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
+    await util.reportActionSucceeded('init');
 }
 run().catch(e => {
     core.setFailed("init action failed: " + e);

lib/upload-lib.js

@@ -54,121 +54,89 @@ function combineSarifFiles(sarifFiles) {
     return JSON.stringify(combinedSarif);
 }
 exports.combineSarifFiles = combineSarifFiles;
-// Upload the given payload.
-// If the request fails then this will retry a small number of times.
-async function uploadPayload(payload) {
-    core.info('Uploading results');
-    const githubToken = core.getInput('token');
-    const ph = new auth.BearerCredentialHandler(githubToken);
-    const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
-    const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
-    // Make up to 4 attempts to upload, and sleep for these
-    // number of seconds between each attempt.
-    // We don't want to backoff too much to avoid wasting action
-    // minutes, but just waiting a little bit could maybe help.
-    const backoffPeriods = [1, 5, 15];
-    for (let attempt = 0; attempt <= backoffPeriods.length; attempt++) {
-        const res = await client.put(url, payload);
-        core.debug('response status: ' + res.message.statusCode);
-        const statusCode = res.message.statusCode;
-        if (statusCode === 202) {
-            core.info("Successfully uploaded results");
-            return true;
-        }
-        const requestID = res.message.headers["x-github-request-id"];
-        // On any other status code that's not 5xx mark the upload as failed
-        if (!statusCode || statusCode < 500 || statusCode >= 600) {
-            core.setFailed('Upload failed (' + requestID + '): (' + statusCode + ') ' + await res.readBody());
-            return false;
-        }
-        // On a 5xx status code we may retry the request
-        if (attempt < backoffPeriods.length) {
-            // Log the failure as a warning but don't mark the action as failed yet
-            core.warning('Upload attempt (' + (attempt + 1) + ' of ' + (backoffPeriods.length + 1) +
-                ') failed (' + requestID + '). Retrying in ' + backoffPeriods[attempt] +
-                ' seconds: (' + statusCode + ') ' + await res.readBody());
-            // Sleep for the backoff period
-            await new Promise(r => setTimeout(r, backoffPeriods[attempt] * 1000));
-            continue;
-        }
-        else {
-            // If the upload fails with 5xx then we assume it is a temporary problem
-            // and not an error that the user has caused or can fix.
-            // We avoid marking the job as failed to avoid breaking CI workflows.
-            core.error('Upload failed (' + requestID + '): (' + statusCode + ') ' + await res.readBody());
-            return false;
-        }
-    }
-    return false;
-}
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
-// Returns true iff the upload occurred and succeeded
 async function upload(input) {
     if (fs.lstatSync(input).isDirectory()) {
         const sarifFiles = fs.readdirSync(input)
             .filter(f => f.endsWith(".sarif"))
             .map(f => path.resolve(input, f));
-        if (sarifFiles.length === 0) {
-            core.setFailed("No SARIF files found to upload in \"" + input + "\".");
-            return false;
-        }
-        return await uploadFiles(sarifFiles);
+        await uploadFiles(sarifFiles);
     }
     else {
-        return await uploadFiles([input]);
+        await uploadFiles([input]);
     }
 }
 exports.upload = upload;
 // Uploads the given set of sarif files.
-// Returns true iff the upload occurred and succeeded
 async function uploadFiles(sarifFiles) {
     core.startGroup("Uploading results");
-    let succeeded = false;
-    // Check if an upload has happened before. If so then abort.
-    // This is intended to catch when the finish and upload-sarif actions
-    // are used together, and then the upload-sarif action is invoked twice.
-    const sentinelFile = await getSentinelFilePath();
-    if (fs.existsSync(sentinelFile)) {
-        core.info("Aborting as an upload has already happened from this job");
-        return false;
+    try {
+        // Check if an upload has happened before. If so then abort.
+        // This is intended to catch when the finish and upload-sarif actions
+        // are used together, and then the upload-sarif action is invoked twice.
+        const sentinelFile = await getSentinelFilePath();
+        if (fs.existsSync(sentinelFile)) {
+            core.info("Aborting as an upload has already happened from this job");
+            return;
+        }
+        const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
+        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+        const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
+        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+        core.debug("Uploading sarif files: " + JSON.stringify(sarifFiles));
+        let sarifPayload = combineSarifFiles(sarifFiles);
+        sarifPayload = fingerprints.addFingerprints(sarifPayload);
+        const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
+        let checkoutPath = core.getInput('checkout_path');
+        let checkoutURI = file_url_1.default(checkoutPath);
+        const workflowRunID = parseInt(workflowRunIDStr, 10);
+        if (Number.isNaN(workflowRunID)) {
+            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+            return;
+        }
+        let matrix = core.getInput('matrix');
+        if (matrix === "null" || matrix === "") {
+            matrix = undefined;
+        }
+        const toolNames = util.getToolNames(sarifPayload);
+        const payload = JSON.stringify({
+            "commit_oid": commitOid,
+            "ref": ref,
+            "analysis_name": analysisName,
+            "sarif": zipped_sarif,
+            "workflow_run_id": workflowRunID,
+            "checkout_uri": checkoutURI,
+            "environment": matrix,
+            "started_at": startedAt,
+            "tool_names": toolNames,
+        });
+        core.info('Uploading results');
+        const githubToken = core.getInput('token');
+        const ph = new auth.BearerCredentialHandler(githubToken);
+        const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
+        const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
+        const res = await client.put(url, payload);
+        const requestID = res.message.headers["x-github-request-id"];
+        core.debug('response status: ' + res.message.statusCode);
+        if (res.message.statusCode === 500) {
+            // If the upload fails with 500 then we assume it is a temporary problem
+            // with turbo-scan and not an error that the user has caused or can fix.
+            // We avoid marking the job as failed to avoid breaking CI workflows.
+            core.error('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else if (res.message.statusCode !== 202) {
+            core.setFailed('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else {
+            core.info("Successfully uploaded results");
+        }
+        // Mark that we have made an upload
+        fs.writeFileSync(sentinelFile, '');
     }
-    const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
-    const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
-    const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
-    const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
-    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
-    core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
-    let sarifPayload = combineSarifFiles(sarifFiles);
-    sarifPayload = fingerprints.addFingerprints(sarifPayload);
-    const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
-    let checkoutPath = core.getInput('checkout_path');
-    let checkoutURI = file_url_1.default(checkoutPath);
-    const workflowRunID = parseInt(workflowRunIDStr, 10);
-    if (Number.isNaN(workflowRunID)) {
-        core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
-        return false;
+    catch (error) {
+        core.setFailed(error.message);
     }
-    let matrix = core.getInput('matrix');
-    if (matrix === "null" || matrix === "") {
-        matrix = undefined;
-    }
-    const toolNames = util.getToolNames(sarifPayload);
-    const payload = JSON.stringify({
-        "commit_oid": commitOid,
-        "ref": ref,
-        "analysis_name": analysisName,
-        "sarif": zipped_sarif,
-        "workflow_run_id": workflowRunID,
-        "checkout_uri": checkoutURI,
-        "environment": matrix,
-        "started_at": startedAt,
-        "tool_names": toolNames,
-    });
-    // Make the upload
-    succeeded = await uploadPayload(payload);
-    // Mark that we have made an upload
-    fs.writeFileSync(sentinelFile, '');
     core.endGroup();
-    return succeeded;
 }

lib/upload-sarif.js

@@ -15,20 +15,16 @@ async function run() {
         return;
     }
     try {
-        if (await upload_lib.upload(core.getInput('sarif_file'))) {
-            await util.reportActionSucceeded('upload-sarif');
-        }
-        else {
-            await util.reportActionFailed('upload-sarif', 'upload');
-        }
+        await upload_lib.upload(core.getInput('sarif_file'));
     }
     catch (error) {
         core.setFailed(error.message);
         await util.reportActionFailed('upload-sarif', error.message, error.stack);
         return;
     }
+    await util.reportActionSucceeded('upload-sarif');
 }
 run().catch(e => {
-    core.setFailed("codeql/upload-sarif action failed: " + e);
+    core.setFailed("upload-sarif action failed: " + e);
     console.log(e);
 });

src/autobuild.ts

@@ -15,8 +15,7 @@ async function run() {
     // We want pick the dominant language in the repo from the ones we're able to build
     // The languages are sorted in order specified by user or by lines of code if we got
     // them from the GitHub API, so try to build the first language on the list.
-    const autobuildLanguages = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]?.split(',') || [];
-    const language = autobuildLanguages[0];
+    const language = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]?.split(',')[0];
 
     if (!language) {
       core.info("None of the languages in this project require extra build steps");
@@ -25,10 +24,6 @@ async function run() {
 
     core.debug(`Detected dominant traced language: ${language}`);
 
-    if (autobuildLanguages.length > 1) {
-      core.warning(`We will only automatically build ${language} code. If you wish to scan ${autobuildLanguages.slice(1).join(' and ')}, you must replace this block with custom build steps.`);
-    }
-
     core.startGroup(`Attempting to automatically build ${language} code`);
     // TODO: share config accross actions better via env variables
     const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
@@ -49,7 +44,7 @@ async function run() {
     core.endGroup();
 
   } catch (error) {
-    core.setFailed("We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps.  " + error.message);
+    core.setFailed(error.message);
     await util.reportActionFailed('autobuild', error.message, error.stack);
     return;
   }
@@ -58,6 +53,6 @@ async function run() {
 }
 
 run().catch(e => {
-  core.setFailed("autobuild action failed.  " + e);
+  core.setFailed("autobuild action failed: " + e);
   console.log(e);
 });

src/config-utils.ts

@@ -75,41 +75,45 @@ function initConfig(): Config {
         return config;
     }
 
-    const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
+    try {
+        const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
 
-    if (parsedYAML.name && typeof parsedYAML.name === "string") {
-        config.name = parsedYAML.name;
-    }
+        if (parsedYAML.name && typeof parsedYAML.name === "string") {
+            config.name = parsedYAML.name;
+        }
 
-    if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
-        config.disableDefaultQueries = parsedYAML['disable-default-queries'];
-    }
+        if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
+            config.disableDefaultQueries = parsedYAML['disable-default-queries'];
+        }
 
-    const queries = parsedYAML.queries;
-    if (queries && queries instanceof Array) {
-        queries.forEach(query => {
-            if (query.uses && typeof query.uses === "string") {
-                config.addQuery(query.uses);
-            }
-        });
-    }
+        const queries = parsedYAML.queries;
+        if (queries && queries instanceof Array) {
+            queries.forEach(query => {
+                if (query.uses && typeof query.uses === "string") {
+                    config.addQuery(query.uses);
+                }
+            });
+        }
 
-    const pathsIgnore = parsedYAML['paths-ignore'];
-    if (pathsIgnore && pathsIgnore instanceof Array) {
-        pathsIgnore.forEach(path => {
-            if (typeof path === "string") {
-                config.pathsIgnore.push(path);
-            }
-        });
-    }
+        const pathsIgnore = parsedYAML['paths-ignore'];
+        if (pathsIgnore && pathsIgnore instanceof Array) {
+            pathsIgnore.forEach(path => {
+                if (typeof path === "string") {
+                    config.pathsIgnore.push(path);
+                }
+            });
+        }
 
-    const paths = parsedYAML.paths;
-    if (paths && paths instanceof Array) {
-        paths.forEach(path => {
-            if (typeof path === "string") {
-                config.paths.push(path);
-            }
-        });
+        const paths = parsedYAML.paths;
+        if (paths && paths instanceof Array) {
+            paths.forEach(path => {
+                if (typeof path === "string") {
+                    config.paths.push(path);
+                }
+            });
+        }
+    } catch (err) {
+        core.setFailed(err);
     }
 
     return config;

src/finalize-db.ts

@@ -150,10 +150,7 @@ async function run() {
     await runQueries(codeqlCmd, databaseFolder, sarifFolder, config);
 
     if ('true' === core.getInput('upload')) {
-      if (!await upload_lib.upload(sarifFolder)) {
-        await util.reportActionFailed('finish', 'upload');
-        return;
-      }
+      await upload_lib.upload(sarifFolder);
     }
 
   } catch (error) {

src/setup-tracer.ts

@@ -238,8 +238,8 @@ async function run() {
         await util.reportActionFailed('init', error.message, error.stack);
         return;
     }
-    await util.reportActionSucceeded('init');
     core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
+    await util.reportActionSucceeded('init');
 }
 
 run().catch(e => {

src/upload-lib.ts

@@ -47,142 +47,96 @@ export function combineSarifFiles(sarifFiles: string[]): string {
     return JSON.stringify(combinedSarif);
 }
 
-// Upload the given payload.
-// If the request fails then this will retry a small number of times.
-async function uploadPayload(payload): Promise<boolean> {
-    core.info('Uploading results');
-
-    const githubToken = core.getInput('token');
-    const ph: auth.BearerCredentialHandler = new auth.BearerCredentialHandler(githubToken);
-    const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
-    const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
-
-    // Make up to 4 attempts to upload, and sleep for these
-    // number of seconds between each attempt.
-    // We don't want to backoff too much to avoid wasting action
-    // minutes, but just waiting a little bit could maybe help.
-    const backoffPeriods = [1, 5, 15];
-
-    for (let attempt = 0; attempt <= backoffPeriods.length; attempt++) {
-
-        const res: http.HttpClientResponse = await client.put(url, payload);
-        core.debug('response status: ' + res.message.statusCode);
-
-        const statusCode = res.message.statusCode;
-        if (statusCode === 202) {
-            core.info("Successfully uploaded results");
-            return true;
-        }
-
-        const requestID = res.message.headers["x-github-request-id"];
-
-        // On any other status code that's not 5xx mark the upload as failed
-        if (!statusCode || statusCode < 500 || statusCode >= 600) {
-            core.setFailed('Upload failed (' + requestID + '): (' + statusCode + ') ' + await res.readBody());
-            return false;
-        }
-
-        // On a 5xx status code we may retry the request
-        if (attempt < backoffPeriods.length) {
-            // Log the failure as a warning but don't mark the action as failed yet
-            core.warning('Upload attempt (' + (attempt + 1) + ' of ' + (backoffPeriods.length + 1) +
-              ') failed (' + requestID + '). Retrying in ' + backoffPeriods[attempt] +
-              ' seconds: (' + statusCode + ') ' + await res.readBody());
-            // Sleep for the backoff period
-            await new Promise(r => setTimeout(r, backoffPeriods[attempt] * 1000));
-            continue;
-
-        } else {
-            // If the upload fails with 5xx then we assume it is a temporary problem
-            // and not an error that the user has caused or can fix.
-            // We avoid marking the job as failed to avoid breaking CI workflows.
-            core.error('Upload failed (' + requestID + '): (' + statusCode + ') ' + await res.readBody());
-            return false;
-        }
-    }
-
-    return false;
-}
-
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
-// Returns true iff the upload occurred and succeeded
-export async function upload(input: string): Promise<boolean> {
+export async function upload(input: string) {
     if (fs.lstatSync(input).isDirectory()) {
         const sarifFiles = fs.readdirSync(input)
             .filter(f => f.endsWith(".sarif"))
             .map(f => path.resolve(input, f));
-        if (sarifFiles.length === 0) {
-            core.setFailed("No SARIF files found to upload in \"" + input + "\".");
-            return false;
-        }
-        return await uploadFiles(sarifFiles);
+        await uploadFiles(sarifFiles);
     } else {
-        return await uploadFiles([input]);
+        await uploadFiles([input]);
     }
 }
 
 // Uploads the given set of sarif files.
-// Returns true iff the upload occurred and succeeded
-async function uploadFiles(sarifFiles: string[]): Promise<boolean> {
+async function uploadFiles(sarifFiles: string[]) {
     core.startGroup("Uploading results");
-    let succeeded = false;
+    try {
+        // Check if an upload has happened before. If so then abort.
+        // This is intended to catch when the finish and upload-sarif actions
+        // are used together, and then the upload-sarif action is invoked twice.
+        const sentinelFile = await getSentinelFilePath();
+        if (fs.existsSync(sentinelFile)) {
+            core.info("Aborting as an upload has already happened from this job");
+            return;
+        }
 
-    // Check if an upload has happened before. If so then abort.
-    // This is intended to catch when the finish and upload-sarif actions
-    // are used together, and then the upload-sarif action is invoked twice.
-    const sentinelFile = await getSentinelFilePath();
-    if (fs.existsSync(sentinelFile)) {
-        core.info("Aborting as an upload has already happened from this job");
-        return false;
+        const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
+        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+        const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
+        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+
+        core.debug("Uploading sarif files: " + JSON.stringify(sarifFiles));
+        let sarifPayload = combineSarifFiles(sarifFiles);
+        sarifPayload = fingerprints.addFingerprints(sarifPayload);
+
+        const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
+        let checkoutPath = core.getInput('checkout_path');
+        let checkoutURI = fileUrl(checkoutPath);
+        const workflowRunID = parseInt(workflowRunIDStr, 10);
+
+        if (Number.isNaN(workflowRunID)) {
+            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+            return;
+        }
+
+        let matrix: string | undefined = core.getInput('matrix');
+        if (matrix === "null" || matrix === "") {
+            matrix = undefined;
+        }
+
+        const toolNames = util.getToolNames(sarifPayload);
+
+        const payload = JSON.stringify({
+            "commit_oid": commitOid,
+            "ref": ref,
+            "analysis_name": analysisName,
+            "sarif": zipped_sarif,
+            "workflow_run_id": workflowRunID,
+            "checkout_uri": checkoutURI,
+            "environment": matrix,
+            "started_at": startedAt,
+            "tool_names": toolNames,
+        });
+
+        core.info('Uploading results');
+        const githubToken = core.getInput('token');
+        const ph: auth.BearerCredentialHandler = new auth.BearerCredentialHandler(githubToken);
+        const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
+        const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
+        const res: http.HttpClientResponse = await client.put(url, payload);
+        const requestID = res.message.headers["x-github-request-id"];
+
+        core.debug('response status: ' + res.message.statusCode);
+        if (res.message.statusCode === 500) {
+            // If the upload fails with 500 then we assume it is a temporary problem
+            // with turbo-scan and not an error that the user has caused or can fix.
+            // We avoid marking the job as failed to avoid breaking CI workflows.
+            core.error('Upload failed (' + requestID + '): ' + await res.readBody());
+        } else if (res.message.statusCode !== 202) {
+            core.setFailed('Upload failed (' + requestID + '): ' + await res.readBody());
+        } else {
+            core.info("Successfully uploaded results");
+        }
+
+        // Mark that we have made an upload
+        fs.writeFileSync(sentinelFile, '');
+
+    } catch (error) {
+        core.setFailed(error.message);
     }
-
-    const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
-    const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
-    const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
-    const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
-    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
-
-    core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
-    let sarifPayload = combineSarifFiles(sarifFiles);
-    sarifPayload = fingerprints.addFingerprints(sarifPayload);
-
-    const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
-    let checkoutPath = core.getInput('checkout_path');
-    let checkoutURI = fileUrl(checkoutPath);
-    const workflowRunID = parseInt(workflowRunIDStr, 10);
-
-    if (Number.isNaN(workflowRunID)) {
-        core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
-        return false;
-    }
-
-    let matrix: string | undefined = core.getInput('matrix');
-    if (matrix === "null" || matrix === "") {
-        matrix = undefined;
-    }
-
-    const toolNames = util.getToolNames(sarifPayload);
-
-    const payload = JSON.stringify({
-        "commit_oid": commitOid,
-        "ref": ref,
-        "analysis_name": analysisName,
-        "sarif": zipped_sarif,
-        "workflow_run_id": workflowRunID,
-        "checkout_uri": checkoutURI,
-        "environment": matrix,
-        "started_at": startedAt,
-        "tool_names": toolNames,
-    });
-
-    // Make the upload
-    succeeded = await uploadPayload(payload);
-
-    // Mark that we have made an upload
-    fs.writeFileSync(sentinelFile, '');
-
     core.endGroup();
-
-    return succeeded;
 }

src/upload-sarif.ts

@@ -9,19 +9,17 @@ async function run() {
     }
 
     try {
-        if (await upload_lib.upload(core.getInput('sarif_file'))) {
-            await util.reportActionSucceeded('upload-sarif');
-        } else {
-            await util.reportActionFailed('upload-sarif', 'upload');
-        }
+        await upload_lib.upload(core.getInput('sarif_file'));
     } catch (error) {
         core.setFailed(error.message);
         await util.reportActionFailed('upload-sarif', error.message, error.stack);
         return;
     }
+
+    await util.reportActionSucceeded('upload-sarif');
 }
 
 run().catch(e => {
-    core.setFailed("codeql/upload-sarif action failed: " + e);
+    core.setFailed("upload-sarif action failed: " + e);
     console.log(e);
 });