CodeQL failed to upload alerts and generated a error as "RequestError [HttpError]: Resource not accessible by integration"

Commencez par le YAML du workflow et l’étape github/codeql-action/upload-sarif@v2, puis examinez la requête PUT signalée vers l’endpoint d’analyse de code scanning. Comparez les permissions du workflow et le contexte d’intégration avec les exigences de téléversement de l’action. Le travail est terminé lorsque la cause du 403 est établie et que le workflow peut téléverser correctement les alertes SARIF.

Summary

CodeQL failed to upload alerts and generated a error as "RequestError [HttpError]: Resource not accessible by integration"

Details

CodeQL generted errors and can't upload sarif files to repositories.

RequestError [HttpError]: Resource not accessible by integration
    at D:\a\_actions\github\codeql-action\v2\node_modules\@octokit\request\dist-node\index.js:66:23
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async Job.doExecute (D:\a\_actions\github\codeql-action\v2\node_modules\bottleneck\light.js:405:18) {
  status: 403,
  headers: {
    'access-control-allow-origin': '*',
    'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
    connection: 'close',
    'content-encoding': 'gzip',
    'content-security-policy': "default-src 'none'",
    'content-type': 'application/json; charset=utf-8',
    date: 'Mon, 05 Jun 2023 22:37:57 GMT',
    'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
    server: 'GitHub.com',
    'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
    'transfer-encoding': 'chunked',
    vary: 'Accept-Encoding, Accept, X-Requested-With',
    'x-content-type-options': 'nosniff',
    'x-frame-options': 'deny',
    'x-github-api-version-selected': '2022-[11](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:12)-28',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': '1406:6C90:64E71DC:CEBA229:647E63C5',
    'x-ratelimit-limit': '1000',
    'x-ratelimit-remaining': '998',
    'x-ratelimit-reset': '1686008277',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '2',
    'x-xss-protection': '0'
  },
  request: {
    method: 'PUT',
    url: 'https://api.github.com/repos/hisashin0728/PoCMDCIaC/code-scanning/analysis/status',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'CodeQL-Action/2.3.6 octokit-core.js/3.1.2 Node.js/16.16.0 (win32; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"workflow_run_id":5182535793,"workflow_run_attempt":1,"workflow_name":"MSDO windows-latest","job_name":"sample","analysis_key":".github/workflows/msdevopssec.yml:sample","commit_oid":"4c8fec07d611c3220[13](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:14)62fe9f39[14](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:15)82439446021","ref":"refs/heads/main","action_name":"upload-sarif","action_ref":"v2","action_oid":"unknown","started_at":"[20](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:21)23-06-05T[22](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:23):37:56.855Z","action_started_at":"20[23](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:24)-06-05T22:37:56.855Z","status":"starting","testing_environment":"","runner_os":"Windows","action_version":"2.3.6","matrix_vars":"null","runner_arch":"X64","runner_os_release":"10.0.20[34](https://github.com/hisashin0728/PoCMDCIaC/actions/runs/5182535793/jobs/9339428218#step:5:35)8"}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  },
  documentation_url: 'https://docs.github.com/rest'
}
Error: Resource not accessible by integration

Here is my configuration YAML file.

name: MSDO windows-latest
on:
  push:
    branches:
      - main

jobs:
  sample:
    name: Microsoft Security DevOps Analysis
    runs-on: windows-latest

    steps:

      # Checkout your code repository to scan
    - uses: actions/checkout@v3

      # Install dotnet, used by MSDO
    - uses: actions/setup-dotnet@v3
      with:
        dotnet-version: |
          5.0.x
          6.0.x

      # Run analyzers
    - name: Run Microsoft Security DevOps Analysis
      uses: microsoft/security-devops-action@preview
      id: msdo
      # For IaC Only
      with:
        categories: 'IaC'

      # Upload alerts to the Security tab
    - name: Upload alerts to Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: ${{ steps.msdo.outputs.sarifFile }}

      # Upload alerts file as a workflow artifact
    - name: Upload alerts file as a workflow artifact
      uses: actions/upload-artifact@v3
      with:  
        name: alerts
        path: ${{ steps.msdo.outputs.sarifFile }}