Git commit sha detection inconsistent between telemetry and actual operations

Open
#3,376 2 comments 0 reactions 1 assignee View on GitHub

@mbg is already working on this.

Since Dec 19, 2025.

Assessment

This issue has not been assessed yet.

Description

See:

https://github.com/github/codeql-action/blob/cac5926de5e2c542638262c4e24527972023cdec/src/status-report.ts#L271-L272

vs:

https://github.com/github/codeql-action/blob/cac5926de5e2c542638262c4e24527972023cdec/src/git-utils.ts#L48-L69

So if the checkout is at a different sha from GITHUB_SHA then the two are different. In my case this made debugging very difficult because when I reran the workflow with debug logging enabled the telemetry calls were printed and showed me it reporting a different sha from the one that is actually used by the upload action.

I suspect this happened because the the telemetry was added later and we originally implemented the "sha of current checkout" behaviour so that it worked outside actions. Removing the "sha of current checkout" behaviour, or making it the lowest priority, feels like the "most correct" fix, but more risky than just changing the telemetry to use the getCommitOid function.

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.