Upload-sarif action doesn't seem to respect "uriBaseId" in SARIF files

Open
#2,215 9 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
github-actions, typescript
Domain
ci-cd, security

Research direction

Start by reproducing the issue with the Android Lint SARIF example and tracing how the v2 upload-sarif action resolves artifact locations. Verify handling of originalUriBaseIds and uriBaseId, then confirm that the resolved path includes the configured base directory and that fingerprinting and code scanning locate the source file.

Written by the indexing model from the issue text.

Description

We're using "Android Lint" to generate a sarif file. The sarif locations use this pattern:

            "originalUriBaseIds": {
                "%SRCROOT%": {
                    "uri": "file:///runner/_work/myrepo/myrepo/some/repo/dir/"
                }
            },
            ...
                             "physicalLocation": {
                                "artifactLocation": {
                                    "uriBaseId": "%SRCROOT%",
                                    "uri": "src/main/kotlin/Foo.kt"
                                },

The artifact location is relative to this uriBaseId. This is a reference to originalUriBaseIds, which the SARIF spec says should be used by consumers to find the absolute path.

However, the upload-sarif action debug logs show lines such as this:

##[debug]Unable to compute fingerprint for non-existent file: /runner/_work/myrepo/myrepo/src/main/kotlin/Foo.kt

which shows that it's not resolving paths using that %SRCROOT% path -- the correct path would be /runner/_work/myrepo/myrepo/some/repo/dir/src/main/kotlin/Foo.kt. We also see that the code scanning page says src/main/kotlin/Foo.kt can't be found in our repo ("Sorry, we couldn't find this file in the repository.").

(Caveat: we're using v2 because we can't use node20 in our private runners yet)

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.