Skip to content

Fix OSSAR workflow: replace github/ossar-action with Microsoft Security DevOps CLI#81

Closed
Copilot wants to merge 4 commits into
JMG3000-OSSAR-workflow-yaml-1from
copilot/sub-pr-79
Closed

Fix OSSAR workflow: replace github/ossar-action with Microsoft Security DevOps CLI#81
Copilot wants to merge 4 commits into
JMG3000-OSSAR-workflow-yaml-1from
copilot/sub-pr-79

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 26, 2026 •
edited
Loading

The workflow claimed to integrate the Microsoft Security DevOps CLI but only ran github/ossar-action. A prior commit also introduced malformed YAML that placed step definitions inside the env: block, rendering the workflow invalid.

Changes

  • Replaced github/ossar-action@v1 with microsoft/security-devops-action@v1 — aligns implementation with the stated intent
  • Fixed broken YAML structure — steps were incorrectly nested under env: instead of under jobs.<job>.steps:
  • Updated workflow name (OSSAR → Microsoft Security DevOps) and job name (OSSAR-Scan → MSDO-Scan) for consistency
  • Updated SARIF output reference: steps.ossar.outputs.sarifFile → steps.msdo.outputs.sarifFile
jobs:
  MSDO-Scan:
    steps:
    - name: Run Microsoft Security DevOps
      uses: microsoft/security-devops-action@v1
      id: msdo

    - name: Upload results to Security tab
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ steps.msdo.outputs.sarifFile }}

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

Copilot AI mentioned this pull request Mar 26, 2026
Closed
@JMG3000
Replace github/ossar-action with microsoft/security-devops-action and…
72bc556 
… fix YAML structure

Co-authored-by: JMG3000 <105582814+JMG3000@users.noreply.github.com>
Agent-Logs-Url: https://github.com/codingUnited/MokseWebsite/sessions/91c019e6-0ff0-40be-8a28-11715c98d4fb
Copilot AI changed the title [WIP] [WIP] Address feedback on OSSAR workflow for static analysis PR Fix OSSAR workflow: replace github/ossar-action with Microsoft Security DevOps CLI Mar 26, 2026
Copilot AI requested a review from JMG3000 March 26, 2026 01:10
@JMG3000 JMG3000 requested a review from Copilot March 26, 2026 01:18
Copilot AI reviewed Mar 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes the repository’s code scanning workflow by replacing the deprecated/incorrect OSSAR action usage with the Microsoft Security DevOps (MSDO) action and correcting the workflow structure so it can run.

Changes:

  • Replace github/ossar-action@v1 with microsoft/security-devops-action@v1.
  • Fix malformed workflow YAML where steps were previously nested under env:.
  • Update workflow/job naming and SARIF upload to reference the MSDO step output.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/ossar.yml Outdated
Comment on lines +34 to +46
- name: Checkout repository
uses: actions/checkout@v4

# Run Microsoft Security DevOps CLI
- name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@v1
id: msdo

# Upload results to the Security tab
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The steps sequence is not indented under the steps: key (the - name: lines are at the same indentation level as steps:), which makes this workflow invalid YAML and will prevent the job from running. Indent all step entries (and their nested keys) so they are children of steps:.

Suggested change
- name: Checkout repository
uses: actions/checkout@v4
# Run Microsoft Security DevOps CLI
- name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@v1
id: msdo
# Upload results to the Security tab
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
- name: Checkout repository
uses: actions/checkout@v4
# Run Microsoft Security DevOps CLI
- name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@v1
id: msdo
# Upload results to the Security tab
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.msdo.outputs.sarifFile }}

Copilot uses AI. Check for mistakes.
@JMG3000
Copy link
Copy Markdown
Contributor

JMG3000 commented Mar 26, 2026

@copilot verify if this PR ,#81, is synced with master.

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@copilot verify if this PR ,#81, is synced with master.

Yes, this PR is synced with master. There are no commits in master that are missing from this branch — the branch simply adds the OSSAR/MSDO workflow changes on top. Also took this opportunity to fix the step indentation in the workflow (commit f38d456).

@JMG3000
Copy link
Copy Markdown
Contributor

JMG3000 commented Mar 26, 2026

@copilot analyze the two conflicts in the changed files and tell me which one is the most up to date after the latest merge.

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@copilot analyze the two conflicts in the changed files and tell me which one is the most up to date after the latest merge.

Here's the analysis of the two conflicting versions of .github/workflows/ossar.yml:

Version A — Base branch (JMG3000-OSSAR-workflow-yaml-1, latest commit acb7b7b via merged PR #82):

  • name: OSSAR, job OSSAR-Scan
  • Keeps both microsoft/security-devops-action@08976cb... (v1.12.0, pinned) AND github/ossar-action@b0197a0... (v1, pinned)
  • continue-on-error: true on the MSDO step
  • security-events: write at top-level permissions
  • Only triggers on push + schedule (no pull_request)

Version B — This PR branch (copilot/sub-pr-79, commit f38d456):

  • name: Microsoft Security DevOps, job MSDO-Scan
  • Uses only microsoft/security-devops-action@v1 — OSSAR action removed entirely
  • security-events: write scoped to job-level permissions
  • Adds pull_request trigger
  • Global FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 env var

Which is most up to date? The base branch version (acb7b7b) is chronologically the most recent — it was merged after this branch was cut. However, it still retains the deprecated github/ossar-action which is the core issue this PR set out to fix. The conflicts arise because both branches modified the same starting broken YAML (173a85e) in incompatible ways — the base branch partially fixed the structure while keeping OSSAR; this branch removed OSSAR entirely and renamed the job/workflow. This PR's version (Version B) is the intended correct state per the stated goal.

@JMG3000
Copy link
Copy Markdown
Contributor

JMG3000 commented Mar 26, 2026

@copilot I want to use both the OSSAR and MS security DevOps. Open a new pull request to repair the toolchain upgrade by amending the code for OSSAR in the ossar.yml and adding a the code for the MS security DevOps tool. I want to review all change before preceeding.

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

5 similar comments
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 26, 2026

@JMG3000 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 4a2f35a2-c78f-4c0c-adcd-0c9df5f3461b

@JMG3000 JMG3000 requested a review from Copilot March 26, 2026 01:40
@JMG3000 JMG3000 review requested due to automatic review settings March 26, 2026 01:40
@JMG3000 JMG3000 requested a review from Copilot March 26, 2026 01:45
Copilot AI reviewed Mar 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/ossar.yml
Comment on lines +28 to +33
env:
# Opt-in early to Node.js 24 for all JavaScript-based actions
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
MSDO-Scan:
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This adds a second top-level env:/jobs: block even though the workflow already defines jobs: above. YAML duplicate keys will cause the earlier jobs: (including OSSAR-Scan) to be ignored or make the workflow invalid depending on the parser. Merge into a single top-level jobs: and keep env: defined only once (either at root or within the job).

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/ossar.yml
# Run Microsoft Security DevOps CLI
- name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@v1
id: msdo
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new step sets id: msdo, but there is already another step later in the same job with id: msdo. Step IDs must be unique within a job; otherwise the workflow fails validation and ${{ steps.msdo.outputs.* }} becomes ambiguous. Remove one of the duplicate steps or give one a different id.

Suggested change
id: msdo
id: msdo_initial

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/ossar.yml
Comment on lines +49 to +51
# Upload results to the Security tab
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

github/codeql-action/upload-sarif@v3 requires with: sarif_file: (or sarif_file via inputs). This step has no with block, so it will fail at runtime. Either add the sarif_file input (likely from steps.msdo.outputs.sarifFile) or remove this redundant upload step.

Suggested change
# Upload results to the Security tab
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/ossar.yml
uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3
with:
sarif_file: ${{ steps.ossar.outputs.sarifFile }}
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step now uploads ${{ steps.msdo.outputs.sarifFile }} but (1) there's already an "Upload MSDO results" step above that uploads the same output, and (2) unlike that step, this one has no if: guard. If sarifFile is empty/undefined, this upload will likely fail the job. Remove this duplicate upload step or restore it to uploading OSSAR output and add an appropriate if: condition.

Suggested change
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
sarif_file: ${{ steps.ossar.outputs.sarifFile }}
if: steps.ossar.outputs.sarifFile

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/ossar.yml
Comment on lines +6 to +8
# This workflow integrates the Microsoft Security DevOps CLI with GitHub code scanning.
# For documentation, visit https://aka.ms/msdo-github
name: Microsoft Security DevOps
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description says OSSAR was replaced, but this workflow file still contains an OSSAR-Scan job and later steps that run github/ossar-action. If the intent is to fully migrate to Microsoft Security DevOps, remove the remaining OSSAR job/steps; if both are intended, update the description and naming to reflect that.

Copilot uses AI. Check for mistakes.
@JMG3000
Copy link
Copy Markdown
Contributor

JMG3000 commented Mar 26, 2026

Review

All changes have been reviewed and rejected based on the need for a re-assessment.

Status:

Denied

@JMG3000 JMG3000 closed this Mar 26, 2026
@JMG3000 JMG3000 deleted the copilot/sub-pr-79 branch March 26, 2026 01:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@JMG3000 JMG3000 Awaiting requested review from JMG3000

Assignees

@JMG3000 JMG3000

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@JMG3000