Please clarify if `github/codeql-action/upload-sarif` is meant to be used on PRs

Open
#3,578 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Stale
Tech stack
github-actions, typescript
Domain
ci-cd, security

Research direction

Start with the github/codeql-action/upload-sarif entry point and review how it is used in workflows triggered by pull requests. Document whether SARIF uploads from PRs are supported, how ephemeral commits are handled, and what workflow configuration is recommended.

Written by the indexing model from the issue text.

Description

Given that the commits in a PR are ephemeral, it is unclear what the action would do with those or if the Github internal does some magic to only flag the commits in active branches. My guess is that we should not be uploading these on PRs at all, but I don't know if there is some other workflow that uses them when they are run on PRs?

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.