Conversation
The github/codeql-action/upload-sarif action requires the local git HEAD to
match the commit being scanned. When the agent job checks out a different
branch (e.g., when creating a PR), the upload fails with "commit not found".
Two fixes are applied to buildUploadCodeScanningSARIFStep:
1. Add a "Reset git HEAD to triggering commit for SARIF upload" step that runs
`git checkout ${{ github.sha }}` before the upload, ensuring the local HEAD
matches the triggering commit.
2. Add `ref: ${{ github.ref }}` and `sha: ${{ github.sha }}` inputs to the
upload-sarif action, explicitly associating the SARIF results with the
correct triggering commit/ref.
Both the reset step and the upload step are conditional on
`steps.process_safe_outputs.outputs.sarif_file != ''`.
Tests are updated to verify the new step and inputs are present.
Fixes #<issue>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d5cc43c1-ee6d-4fb2-a8f0-5bdd1b6840a3
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add additional git commit references for SARIF upload
fix: add git HEAD reset and explicit ref/sha to SARIF upload step
Apr 3, 2026
Collaborator
|
@copilot use the information in the checkout manager to restore the current checkout |
Instead of a raw `git checkout ${{ github.sha }}` command, use a proper
`actions/checkout` step that leverages the checkout manager's information
(user-configured checkout token from frontmatter) to restore the workspace
to the triggering commit before SARIF upload.
The new `resolveRestoreCheckoutToken` method consults the checkout manager
for the user's configured checkout token (checkout: github-token: ...) and
falls back to the PR checkout token chain if no override is present.
This ensures credentials are handled consistently with the rest of the
safe_outputs job and works correctly even without a prior PR checkout.
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5ebfad75-31de-4db1-bb25-505c7ba62c67
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in b4df5c8. Replaced the raw |
Copilot
AI
changed the title
fix: add git HEAD reset and explicit ref/sha to SARIF upload step
fix: add actions/checkout restore and explicit ref/sha to SARIF upload step
Apr 3, 2026
Collaborator
|
@copilot move create code scanning alerts in own job to avoid interfering with other safe_jobs. needs safe_outputs and if only there is work to do |
Collaborator
|
@copilot merge main and update checkout secret from outputs |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5d63b40a-5b47-473d-80ed-f5d7ee0de07d Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
The SARIF restore checkout and upload steps are moved out of the consolidated safe_outputs job into a dedicated upload_code_scanning_sarif job that: - needs: [safe_outputs] - if: needs.safe_outputs.outputs.sarif_file != '' (only runs when there is work) - permissions: contents:read, security-events:write This avoids the repo checkout (needed to restore HEAD to github.sha) from interfering with other safe-output operations (create-pull-request, push-to-pull-request-branch, etc.) that also modify the workspace checkout in the consolidated safe_outputs job. The safe_outputs job still exports sarif_file so the new job can gate on it. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5d63b40a-5b47-473d-80ed-f5d7ee0de07d Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in c56d31f. The SARIF restore checkout and upload are now in a dedicated
The Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: add actions/checkout restore and explicit ref/sha to SARIF upload step
fix: add actions/checkout restore, explicit ref/sha, and dedicated upload job for SARIF upload
Apr 3, 2026
Collaborator
|
@copilot the sariff file needs to be uploaded in an artifact and downloaded in the sariff job |
Collaborator
|
@copilot update smoke-Claude to post a dummy warning code alert using the safe output |
…oad-git-commit-references Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
- Merge origin/main (includes feat: bundle token usage, fix: wasm golden files)
- Add computeStaticCheckoutToken helper that computes a static checkout token
(secret ref) without referencing any step output — safe to export as a job output
- Export checkout_token from safe_outputs job when create-code-scanning-alert
is configured; the value is the static PAT or default GH_AW_GITHUB_TOKEN ||
GITHUB_TOKEN (GitHub App tokens are excluded because they are minted and revoked
in safe_outputs, so they would be invalid by the time the upload job runs)
- buildCodeScanningUploadJob now uses needs.safe_outputs.outputs.checkout_token
for both the restore checkout step and addUploadSARIFToken, removing the
broken step-output reference (${{ steps.safe-outputs-app-token.outputs.token }})
that did not exist in the separate job context
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f1d25327-92dd-47a9-bbed-2121e981af50
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 46efb86. Merged main — all 183 workflows recompiled cleanly. Checkout token from outputs: The Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: add actions/checkout restore, explicit ref/sha, and dedicated upload job for SARIF upload
fix: dedicated upload_code_scanning_sarif job with checkout token from safe_outputs outputs
Apr 3, 2026
Collaborator
|
@copilot fix tests + ensure that the custom github-token, github-app for the checkout is support in the new job |
…tests Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8a1bd4b1-943a-420a-95a3-69ef317b4ef5 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in e64db0e. Tests fixed: Updated github-app and github-token checkout support:
Two new test cases added: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: dedicated upload_code_scanning_sarif job with SARIF artifact transfer and direct checkout token computation
fix: dedicated upload_code_scanning_sarif job with SARIF artifact transfer, direct checkout token computation, and github-app checkout support
Apr 3, 2026
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
|
Smoke Test Results for run §23960187842
Overall: ❌ FAIL — PR author:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Smoke test review of PR #24322: The dedicated upload_code_scanning_sarif job approach cleanly separates the SARIF artifact transfer from the safe_outputs job. New constants in pkg/constants/job_constants.go follow established patterns. ✅
📰 BREAKING: Report filed by Smoke Copilot · ● 775.4K
| const DetectionJobName JobName = "detection" | ||
| const SafeOutputsJobName JobName = "safe_outputs" | ||
| const UploadAssetsJobName JobName = "upload_assets" | ||
| const UploadCodeScanningJobName JobName = "upload_code_scanning_sarif" |
Contributor
There was a problem hiding this comment.
Clean addition of the UploadCodeScanningJobName constant using the JobName semantic type — consistent with SafeOutputsJobName, UploadAssetsJobName, etc. The constant name accurately reflects the job purpose.
| // downloads the SARIF artifact. The file will be available at this path + the SARIF | ||
| // filename ("code-scanning-alert.sarif") after actions/download-artifact completes. | ||
| const SarifArtifactDownloadPath = "/tmp/gh-aw/sarif/" | ||
|
|
Contributor
There was a problem hiding this comment.
Nice grouping of the three new SARIF-related constants (SarifArtifactName, SarifArtifactDownloadPath, SarifFileName). The documentation comments clearly explain the artifact transfer pipeline between safe_outputs and upload_code_scanning_sarif jobs.
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Contributor
|
Smoke Test 23960187828 — PARTIAL (17✅ 2 Core: 1✅ 2✅ 3✅ 4✅ 5✅ 6✅ 7✅ 8✅ 9✅ 10✅ 11✅ 12✅
|
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude · ● 373.1K
| # inlined-imports: true | ||
| # | ||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"c8e85b0ffed195e6ee17c58abdbf3bbfcbd97a8f97be8d1041ee2fe72da2ce8b","agent_id":"claude"} | ||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"21ff673e699d808782479870bf351cdbf8f6b95415b21decc3c7721a95f0e281","agent_id":"claude"} |
Contributor
There was a problem hiding this comment.
Smoke test review comment #1 (Run 23960187828): The frontmatter hash update reflects the new create_code_scanning_alert safe-output tool addition — this is expected and correct.
| - activation | ||
| - agent | ||
| - safe_outputs | ||
| - upload_code_scanning_sarif |
Contributor
There was a problem hiding this comment.
Smoke test review comment #2 (Run 23960187828): The upload_code_scanning_sarif job dependency is correctly added to the conclusion job's needs list — ensures SARIF upload completes before conclusion runs.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github/codeql-action/upload-sariffails with "commit not found" when the safe_outputs job has checked out a different branch for PR operations (e.g., the base branch), because the local HEAD no longer matches the triggering commit. Additionally, the SARIF file generated insafe_outputsis not available in the separate upload job's fresh workspace.Changes
upload_code_scanning_sarifjob: The SARIF restore checkout and upload are moved out of the consolidatedsafe_outputsjob into their own separate job. This prevents the workspace checkout swap (needed to restore HEAD togithub.sha) from interfering with other safe-output operations running insafe_outputs(e.g.,create-pull-request,push-to-pull-request-branch)needs: [safe_outputs]if: needs.safe_outputs.outputs.sarif_file != ''— only runs when there is work to dopermissions: contents: read, security-events: writesafe_outputs: Afterprocess_safe_outputsruns, the SARIF file is uploaded as a GitHub Actions artifact (code-scanning-sarif,retention-days: 1), conditional onsarif_file != ''. This is required because the upload job runs in a fresh workspace and cannot access files from thesafe_outputsworkspace via job-output path strings alone.upload_code_scanning_sarif: The upload job downloads thecode-scanning-sarifartifact to/tmp/gh-aw/sarif/and passes the local path directly togithub/codeql-action/upload-sarif.upload_code_scanning_sarif: The token is computed directly insidebuildCodeScanningUploadJobrather than passing it throughsafe_outputsjob outputs — GitHub Actions silently masks job outputs that contain secret references, causing the downstream job to receive an empty string and fail with "Input required and not supplied: token".checkout: github-app:support in the upload job: When the default checkout is configured with a GitHub App,buildCodeScanningUploadJobmints a fresh token (step IDcheckout-restore-app-token) at the top of the upload job usingbuildGitHubAppTokenMintStep. The activation/safe_outputs app tokens have expired by this point, so a new token must be minted. The minted token (${{ steps.checkout-restore-app-token.outputs.token }}) is used for both the restore-checkout step and theupload-sariftoken input.checkout: github-token:support in the upload job: When the default checkout is configured with a static PAT,computeStaticCheckoutTokenpicks it up fromCheckoutManagerand uses it directly.sarif_filejob output onsafe_outputsso the new job can gate onneeds.safe_outputs.outputs.sarif_file != ''.actions/checkoutwith the computed token (static PAT, minted app token, or default) to restore the workspace to the triggering commit before SARIF upload.ref/shainputs onupload-sarif: pins the upload to the correct commit/ref regardless of local git state.smoke-claude.mdupdated: Addedcreate-code-scanning-alert: driver: "Smoke Claude"safe output and a new test step (Weekly Research Report: AI Workflow Automation Landscape and Strategic Opportunities - August 2025 #12) that posts a dummy warning code scanning alert to exercise the full SARIF artifact upload/download pipeline. Fixedpush-to-pull-request-branchallowed-filesto usesmoke-test-files/smoke-claude-push-test.mdinstead of.github/smoke-claude-push-test.md— the.github/prefix is inprotected_path_prefixesso the old path caused safe_outputs to fail.These fixes are now baked into the compiler so
gh aw compilegenerates them automatically — no more manual lock file patching after every recompile.✨ PR Review Safe Output Test - Run 23960187828