Failed to upload database for java: HttpError: Not Found

Bắt đầu với bước Perform CodeQL Analysis của workflow CodeQL và phiên bản action github/codeql-action/analyze@8b37404d562d866ad6a65d0ecb4fa5131e047ca4. Theo dõi yêu cầu tải cơ sở dữ liệu lên đến endpoint được hiển thị /code-scanning/codeql/databases/java và so sánh với phản hồi 404 được ghi lại. Hoàn tất khi việc tải cơ sở dữ liệu Java lên thành công mà không có cảnh báo và CodeQL được Scorecard phát hiện.

Describe the bug
I enabled CodeQL but did not see SAST being recognized when running scorecard in docker:

----------|-----------------------------------------------------------------------------------------------------
| 0 / 10  | SAST                   | SAST tool is not run on all    | Warn: 1 commits out of 30 are       
|         |                        | commits -- score normalized to | checked with a SAST tool Warn:    
|         |                        | 0                              | CodeQL tool not detected    
           https://github.com/ossf/scorecard/blob/a69e1d97d44ebba908ad4cf574d51c0f2e0f761e/docs/checks.md#sast  

@laurentsimon noticed

... that CodeQl is defined in your workflow, but seems to fail uploading the results: https://github.com/remkop/picocli/actions/runs/1794898507 which may be why scorecard is not detecting it.

It appears that the upload fails at the end of the "Perform CodeQL Analysis" job in the .github/workflows/codeql-analysis.yml in my repo:

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8b37404d562d866ad6a65d0ecb4fa5131e047ca4 # v1

I initially thought this was a ossf scorecard issue and reported it as such in https://github.com/ossf/scorecard/issues/1605, but the underlying issue may be in the codeql-action.

Relevant section from the log follows below:

Run github/codeql-action/analyze@8b37404d56[2](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:2)d866ad6a65d0ecb4fa51[3](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:3)1e0[4](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:4)7ca4
  with:
    output: ../results
    upload: true
    cleanup-level: brutal
    add-snippets: false
    skip-queries: false
    checkout_path: /home/runner/work/picocli/picocli
    upload-database: true
    wait-for-processing: false
    token: ***
    matrix: {
    "language": "java"
  }
  env:
    CODEQL_ACTION_RUN_MODE: Action
    CODEQL_ACTION_VERSION: 1.0.30
    CODEQL_ACTION_FEATURE_SARIF_COMBINE: true
    CODEQL_ACTION_FEATURE_WILL_UPLOAD: true
    CODEQL_ACTION_ANALYSIS_KEY: .github/workflows/codeql-analysis.yml:analyze
    CODEQL_WORKFLOW_STARTED_AT: 2022-02-04T12:2[5](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:5):12.314Z
    CODEQL_ACTION_FEATURE_MULTI_LANGUAGE: false
    CODEQL_ACTION_FEATURE_SANDWICH: false
    CODEQL_RAM: 5923
    CODEQL_THREADS: 2
    ODASA_TRACER_CONFIGURATION: /home/runner/work/_temp/codeql_databases/working/tracing/compiler-tracing52835[6](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:6)9625230668[7](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:7)17.spec
    SEMMLE_JAVA_TOOL_OPTIONS: '-javaagent:/opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/java/tools/codeql-java-agent.jar=ignore-project,java' '-Xbootclasspath/a:/opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/java/tools/codeql-java-agent.jar'
    SEMMLE_PRELOAD_libtrace: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/${LIB}_${PLATFORM}_trace.so
    SEMMLE_PRELOAD_libtrace32: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/lib32trace.so
    SEMMLE_PRELOAD_libtrace64: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/lib64trace.so
    CODEQL_SCRATCH_DIR: /home/runner/work/_temp/codeql_databases/working
    CODEQL_DIST: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql
    CODEQL_PLATFORM: linux64
    CODEQL_PLATFORM_DLL_EXTENSION: .so
    CODEQL_JAVA_HOME: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/java
    CODEQL_EXTRACTOR_JAVA_ROOT: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/java
    CODEQL_EXTRACTOR_JAVA_WIP_DATABASE: /home/runner/work/_temp/codeql_databases/java
    CODEQL_EXTRACTOR_JAVA_LOG_DIR: /home/runner/work/_temp/codeql_databases/java/log
    CODEQL_EXTRACTOR_JAVA_SCRATCH_DIR: /home/runner/work/_temp/codeql_databases/java/working
    CODEQL_EXTRACTOR_JAVA_TRAP_DIR: /home/runner/work/_temp/codeql_databases/java/trap/java
    CODEQL_EXTRACTOR_JAVA_SOURCE_ARCHIVE_DIR: /home/runner/work/_temp/codeql_databases/java/src
    CODEQL_EXTRACTOR_JAVA_THREADS: 2
    CODEQL_EXTRACTOR_JAVA_RAM: 5923
    LD_PRELOAD: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/${LIB}_${PLATFORM}_trace.so
    CODEQL_RUNNER: /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/tools/linux64/runner
/opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/codeql version --format=terse
2.7.6
Finalizing java
Running queries for java
Interpreting results for java
Analysis produced the following diagnostic data:

|             Diagnostic             |                      Summary                       |
+------------------------------------+----------------------------------------------------+
| Extraction errors                  | 1 result (1 error)                                 |
| Diagnostics for framework coverage | 132 results (101 unknowns, 10 errors, 21 warnings) |
| Successfully extracted files       | 2[8](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:8)[9](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:9) results                                        |
| Extraction warnings                | 0 results                                          |
Analysis produced the following metric data:

|               Metric                | Value |
+-------------------------------------+-------+
| Total lines of code in the database | 65807 |

/opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/codeql database print-baseline /home/runner/work/_temp/codeql_databases/java
Counted a baseline of 67865 lines of code for java.
Counted a baseline of 67865 lines of code for java.

Cleaning up databases
  /opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/codeql database cleanup /home/runner/work/_temp/codeql_databases/java --mode=brutal
  Cleaning up existing TRAP files after import...
  TRAP files cleaned up (3ms).
  Cleaning up scratch directory...
  Scratch directory cleaned up (0ms).

Uploading results
  Processing sarif files: ["/home/runner/work/picocli/results/java.sarif"]
  Uploading results
  Successfully uploaded results
/opt/hostedtoolcache/CodeQL/0.0.0-20220120/x64/codeql/codeql database bundle /home/runner/work/_temp/codeql_databases/java --output=/home/runner/work/_temp/codeql_databases/java.zip --name=java
Creating bundle metadata for /home/runner/work/_temp/codeql_databases/java...
Creating zip file at /home/runner/work/_temp/codeql_databases/java.zip.
RequestError [HttpError]: Not Found
    at /home/runner/work/_actions/github/codeql-action/8b37404d562d866ad6a65d0ecb4fa5131e047ca4/node_modules/@octokit/request/dist-node/index.js:66:23
    at processTicksAndRejections (internal/process/task_queues.js:93:5)
    at async Job.doExecute (/home/runner/work/_actions/github/codeql-action/8b37404d562d866ad6a65d0ecb4fa5131e047ca4/node_modules/bottleneck/light.js:405:18) {
  name: 'HttpError',
  status: 404,
  headers: {
    'access-control-allow-origin': '*',
    'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
    connection: 'close',
    'content-encoding': 'gzip',
    'content-security-policy': "default-src 'none'",
    'content-type': 'application/json; charset=utf-8',
    date: 'Fri, 04 Feb 2022 12:30:45 GMT',
    'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
    server: 'GitHub.com',
    'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
    'transfer-encoding': 'chunked',
    vary: 'Accept-Encoding, Accept, X-Requested-With',
    'x-content-type-options': 'nosniff',
    'x-frame-options': 'deny',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': '0780:7AD8:CB9C09:1E2FF0E:61FD1C75',
    'x-ratelimit-limit': '[10](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:10)00',
    'x-ratelimit-remaining': '987',
    'x-ratelimit-reset': '164398[11](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:11)[12](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:12)',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '[13](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:13)',
    'x-xss-protection': '0'
  },
  request: {
    method: 'PUT',
    url: 'https://api.github.com/repos/remkop/picocli/code-scanning/codeql/databases/java',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'CodeQL-Action/1.0.30 octokit-core.js/3.1.2 Node.js/12.13.1 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: <Buffer 50 4b 03 04 [14](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:14) 00 08 08 08 00 d4 63 44 54 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 6a 61 76 61 2f 2e 64 62 69 6e 66 6f 6d 52 cb 4e c3 30 10 bc ... 1404[17](https://github.com/remkop/picocli/runs/5066373526?check_suite_focus=true#step:7:17)05 more bytes>,
    request: { agent: [Agent], hook: [Function: bound bound register] }
  },
  documentation_url: 'https://docs.github.com/rest'
}
Warning: Failed to upload database for java: HttpError: Not Found