Submit SARIF for failed runs too #1393
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
henrymercer
force-pushed
the
henrymercer/report-failed-runs
branch
from
39c59d2 to
7cef3cf
Compare
henrymercer
force-pushed
the
henrymercer/report-failed-runs
branch
from
91edebd to
61ec68f
Compare
henrymercer
force-pushed
the
henrymercer/report-failed-runs
branch
from
61ec68f to
7fc3c60
Compare
3 tasks
aeisenberg
reviewed
Nov 29, 2022
aeisenberg
reviewed
Nov 29, 2022
aeisenberg
reviewed
Dec 1, 2022
This was referenced Dec 8, 2022
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR helps us better surface failed code scanning workflow runs by attempting to submit a SARIF file containing
executionSuccessful: falsein some of these cases. We take special care to ensure that we respect SARIF categories andupload: falseoptions to avoid stale tips. This is made more difficult by the fact that these are only passed to theanalyzeAction. We want to handle cases where the workflow fails before theanalyzestep, and we don't have access to these inputs in the post-init step. Therefore we resort to a best-effort attempt at working out what the inputs were based on the workflow file and the variables we do have access to in the post-init step.We don't to cover every case where the workflow fails here. Cases where the workflow run is cancelled or times out won't be possible to handle — we'd need a different mechanism to notify Code Scanning about these. However this PR will cover many of the cases where workflows fail so we can start providing a better experience.
Merge / deployment checklist