Produce separate SARIF file for quality-queries alerts
#2935
+297
−43
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87b6687 to
fe76653
Compare
2bf7322 to
24e4f58
Compare
7e59f77 to
f7fbaa0
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR enables separate generation and upload of SARIF files for code-quality queries specified via the quality-queries input, in addition to the existing code-scanning SARIF flow.
- Introduces
SARIF_UPLOAD_TARGETenum andUploadTargetinterface to distinguish code scanning vs. code quality uploads. - Extends file discovery (
findSarifFilesInDir,getSarifFilePaths) and upload logic (uploadFiles,uploadPayload,validateUniqueCategory) to filter and handle.quality.sariffiles. - Updates
analyze.ts/analyze-action.tsto produce and upload quality SARIFs whenquality-queriesare provided, and adjusts CI workflows to upload/check both SARIF artifacts.
Reviewed Changes
Copilot reviewed 12 out of 17 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/upload-lib.ts | Added enum and targets for separate SARIF uploads, filtering logic for .quality.sarif. |
| src/upload-lib.test.ts | Added tests for filtering .quality.sarif files and validateUniqueCategory prefix. |
| src/analyze.ts | Introduced default query suites and resolveQuerySuiteAlias; generate quality SARIF. |
| src/analyze.test.ts | Added tests for resolveQuerySuiteAlias. |
| src/analyze-action.ts | Uploads quality SARIF and sets quality-sarif-id output when quality-queries present. |
| pr-checks/checks/quality-queries.yml | CI updates to upload security vs. quality SARIF artifacts and adjust checks. |
Comments suppressed due to low confidence (2)
src/upload-lib.ts:427
- The
getSarifFilePathsfunction bypasses theisSariffilter whensarifPathis a single file. This can lead to uploading unwanted files (e.g., a.quality.sarifwhen targeting code-scanning). ApplyisSarifto the single-file case or throw if it does not match.
sarifFiles = [sarifPath];
pr-checks/checks/quality-queries.yml:29
- [nitpick] The CI step now only checks config properties in the quality SARIF, omitting the original security SARIF check. Consider adding a separate check for
${{ runner.temp }}/results/javascript.sarifto ensure both artifacts are validated.
SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Follows on from #2917.
This PR modifies the action to produce separate SARIF files for code quality queries (as specified as arguments to the
quality-queriesinput) and uploads them to the code quality API. The approach here is that:database interpret-resultsfor queries that were specified as arguments to thequality-queriesinput (if any). This results in SARIF files for those queries.Notes
quality-queriesalerts.Merge / deployment checklist