From f9ee239c4f15df9163aac39c95fb0cd4c2a5035b Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sun, 26 Jul 2026 00:36:58 +0200 Subject: [PATCH] fix(ci): make the code-scanning SARIF upload best-effort Correcting the SARIF filename in #47 made this step reachable for the first time -- and it immediately failed the Security job on lexora with "Resource not accessible by integration". Code scanning ingest requires GitHub Advanced Security on private repositories, and most of the fleet is private. That is a regression introduced by #47: while the step was looking for a filename nox never writes, hashFiles() never matched, so the missing permission could not surface. Fixing the lookup exposed it. continue-on-error, because this upload is reporting, not enforcement. The gate step below is what decides pass/fail, and it is unaffected -- on the same lexora run it evaluated correctly and reported "net-new critical/ high: 0 (baselined findings: 57)". A repo without Advanced Security should still get its security gate; it just does not also get the findings mirrored into the code-scanning UI. Same rationale already applied to the taint-plugin install in this file. Claude-Session: https://claude.ai/code/session_01LMVPJFeTCEtUk2CSNBBBdK --- .github/workflows/go-ci.yml | 10 ++++++++++ .github/workflows/js-ci.yml | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml index 60ad452..019769d 100644 --- a/.github/workflows/go-ci.yml +++ b/.github/workflows/go-ci.yml @@ -195,6 +195,16 @@ jobs: # gate step below decides what is actually fatal (net-new crit/high). run: nox scan ${{ inputs.working-directory }} -format json,sarif -output nox-results || true - name: Upload SARIF to code scanning + # Best-effort. Code scanning ingest needs GitHub Advanced Security on + # private repos; without it the upload returns "Resource not accessible + # by integration" and would fail the whole Security job. Most of the + # fleet is private, and the gate below -- not this upload -- is the + # enforcement. Same rationale as the taint-plugin install above. + # + # This only became reachable once the filename was corrected from + # findings.sarif to results.sarif: the step had silently skipped since + # it was added, so the permission problem had never surfaced. + continue-on-error: true if: always() && hashFiles('nox-results/results.sarif') != '' uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4 with: diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml index 7c11c27..0fb3c73 100644 --- a/.github/workflows/js-ci.yml +++ b/.github/workflows/js-ci.yml @@ -149,6 +149,16 @@ jobs: # Go-only taint-analysis plugin is intentionally NOT installed here. run: nox scan ${{ inputs.working-directory }} -format json,sarif -output nox-results || true - name: Upload SARIF to code scanning + # Best-effort. Code scanning ingest needs GitHub Advanced Security on + # private repos; without it the upload returns "Resource not accessible + # by integration" and would fail the whole Security job. Most of the + # fleet is private, and the gate below -- not this upload -- is the + # enforcement. Same rationale as the taint-plugin install above. + # + # This only became reachable once the filename was corrected from + # findings.sarif to results.sarif: the step had silently skipped since + # it was added, so the permission problem had never surfaced. + continue-on-error: true # `-output nox-results` writes results.sarif and findings.json. The SARIF # was looked up as findings.sarif, so hashFiles() never matched and this # step has silently skipped on every run since it was added — code