Open h3xstream opened 3 years ago
Normally, there should be a failing code scanning workflow run in the Actions tab of your repository. The fact that the latest scan has a duration of 1s, implies to me that the workflow didn't really run at all (or at least it was aborted shortly after starting).
Can you locate which run this was? And add the logs?
If this repo is public, can you share the link?
Hi This is the workflow: https://github.com/h3xstream/sarif-samples/actions/workflows/upload-me.yml
Thanks for the information. I've forwarded this on to the code scanning team and someone should follow up.
:wave: @h3xstream We have few additional expectations from the SARIF file that are stricter than what the standard requires. These are meant to provide a reasonable UI experience. One of those is that each result should have a message. The file you uploaded does not include these values.
You can see the full explanation at: https://docs.github.com/en/code-security/secure-coding/integrating-with-code-scanning/sarif-support-for-code-scanning#result-object
To further debug this type of problems, you can use the Code Scanning API endpoint to list analyses. These errors are reported under the error
property: https://docs.github.com/en/rest/reference/code-scanning#list-code-scanning-analyses-for-a-repository
Hope this helps!
So, I'm looking at
Thoughts:
Analysis processing failed
should be a link to something. Preferably to a report showing the specific complaint(s). Alternatively, to a page explaining how to debug a failure.results_count
and rules_count
aren't populated unless the sarif parser is entirely happy, ...
When we see "Analysis processing failed", where should we look to investigate what failed?
The ouput of the CodeQL action is saying