CodeQL codesign error message

Commencez par l’étape de workflow github/codeql-action/init@v2 et comparez la sortie de build de Fastlane avec et sans initialisation. Utilisez l’échec de CodeSign et les entrées du journal de débogage comme points d’investigation ; le travail est terminé lorsqu’il est expliqué pourquoi les signatures sont remplacées et si ce remplacement provoque l’analyse en échec.

We`re workin on CodeQL Static Application Security Testing (SAST) implementation for a Swift language using GitHub Actions. During this process, I encountered an issue with the CodeQL initialization step when integrating with a Fastlane-based build process.

When including the CodeQL initialization step (github/codeql-action/init@v2) in the GitHub Actions workflow before Fastlane-based build commands, the build job fails with a CodeSign error. The specific error message indicates that the CodeSign command has failed.

Interesting Behavior: if I remove the CodeQL initialization step from the GitHub Actions workflow, the build application process works perfectly without any issues - application builds well.

Error message from console output:

▸ ** ARCHIVE FAILED **
▸ The following build commands failed:
▸ 	CodeSign /Users/runner/Library/Developer/Xcode/DerivedData/APP-amdyapuwajsvoeelnrjmqpntrblu/Build/Intermediates.noindex/ArchiveIntermediates/APP_straging/IntermediateBuildFilesPath/UninstalledProducts/iphoneos/SaleforceNotificationService_staging.appex (in target 'SaleforceNotificationService_staging' from project 'APP')
▸ (1 failure)

From debug logs we got below entries:

/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.x86_64
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.x86_64: replacing existing signature
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.arm64
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.arm64: replacing existing signature
[T 17:01:12 33906] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33908] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33909] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33913] Attempting to switch stdout/stderr to 7...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.145DE1E8.slice.x86_64: replacing existing signature
[T 17:01:12 33914] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33912] Initializing tracer.
[T 17:01:12 33912] Initialising tags...
[T 17:01:12 33912] ID set to 0000000000008478_0000000000000001 (parent 0000000000008433_0000000000000001)
[T 17:01:12 33912] ==== Candidate to intercept: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache (canonical: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache) ====
[T 17:01:12 33912] Executing the following tracer actions:
[T 17:01:12 33912] Tracer actions:
[T 17:01:12 33912] pre_invocations(0)
[T 17:01:12 33912] post_invocations(0)
[T 17:01:12 33912] trace_languages(1): [swift]
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature

Why codeql replace signature and is it the case for failing our scan ?