Repository navigation
Revert code-ql-action/upload-sarif #3517
Description
Revert #3459
We have a short term workaround thanks to @adityasharad
Short term workaround: please try removing the TAR file /release-images/code-server-amd64-3.10.2.tar (and others like it) from the workspace before running the upload step.
UPDATE: a PR has been merged github/codeql-action#550
So we should be able to re-enable without using the workaround.
Activity
[-]Remove TAR files in /release-images and revert code-ql-action/upload-sarif[/-][+]Revert code-ql-action/upload-sarif[/+]edoardopirovano commentedon Jun 7, 2021
Note that my PR has been merged in the
mainbranch of the CodeQL action while your workflow is using@v1. So, it will be a little bit longer before the fix reaches you (we usually release tov1every week or two).jsjoeio commentedon Jun 7, 2021
Ah...good to know. Thanks for pointing that out @edoardopirovano 👍🏼
jsjoeio commentedon Jun 22, 2021
Looks like there is a new release out, so I think this is fine to upgrade: https://github.com/github/codeql-action/releases/tag/codeql-bundle-20210622
edoardopirovano commentedon Jun 23, 2021
Almost! The CodeQL Action that your workflow is running still hasn't been bumped to use the latest version, that should happen once this PR is merged later today:
github/codeql-action#585
Once that's merged you should be all good to go ahead with this 🙂
jsjoeio commentedon Jun 23, 2021
Ahh... Got it. Guess the release notification was a false alarm!
Thanks for the heads-up and linking the PR 😄
jsjoeio commentedon Jul 7, 2021
The GitHub Action side is fixed but now it seems like there's an issue on the trivy side (see aquasecurity/trivy#1080).
I looked into reverting this in #3727 but it seems like it's more work than it's worth at this time. I will revisit later (hoping that the upstream trivy issue is fixed).
If this gets revisited, and the upstream issue isn't fixed, we can look into uploading the Docker image per PR to the GitHub Container Registry. Some resources: