[Bug]: Output sarif is wrong when using on github actions

[Perdiga]

What happened?

When running

- name: Initialize and Analyze IaC
        id: codeql_iac
        uses: advanced-security/codeql-extractor-iac@v0.5.0

It says that the sarif was exported to: /github/workspace/.codeql/results/iac-results.sarif

But actually is going to: ./.codeql/results/iac-results.sarif

Version

0.1.0

Relevant log output

[GeekMasher]

Thanks for raising this @Perdiga , must have been when I upgraded to the new Container based CodeQL extractor action. Let me get this resolved along with another bug for v0.5.1

[lfventura]

Thats what I did to solve this issue:

      - name: Analyze IaC
        id: codeql_iac
        uses: advanced-security/codeql-extractor-iac@main
      - name: Adjust tool name for CodeQL IAC upload
        # Github since version 0.5.0 set the tool name to "CodeQL - IAC" which breaks compatibility with past tests
        # This will revert the name to "CodeQL" only for the IaC sarif file, keeping the compatibility with past tests
        run: |
          cat .codeql/results/iac-results.sarif | sed -e s/"CodeQL - IAC"/"CodeQL"/g > /tmp/iac-results.sarif.new
          sudo mv -f /tmp/iac-results.sarif.new .codeql/results/iac-results.sarif
          sudo chown root:root .codeql/results/iac-results.sarif 
      - name: Upload IaC Sarif
        uses: github/codeql-action/upload-sarif@v3
        with:
          # Github changed on version codeql-extractor-iac 0.5.0. The output sarif-results only indicates a directory with incorrect info. This forces the use of the correct file.
          sarif_file: ".codeql/results/iac-results.sarif"
        env:
          CODEQL_ACTION_ANALYSIS_KEY: codeql_iac_scan

I also had to do the sed, because the TOOL is now different and it was giving CodeQL configuration not found for all my repos, as before the tool name was just CodeQL.

[GeekMasher]

@lfventura Can you create a separate issue for your comment? This is something I did to stop issues with CodeQL Default Setup on the same repository which break the IaC extractor from uploading. We could add a argument in the action to "stop the rewriting of the SARIF file"

[GeekMasher]

Created a PR to allow you to stop the re-writing. Will be added as part of the next release

advanced-security/codeql-extractor-action#28

[GeekMasher]

@Perdiga I found out the issue. It was to do with the new v0.5+ action being put in a container which changed some of the paths. I have now added support for this to be relative to the working directory.

https://github.com/advanced-security/codeql-extractor-iac/releases/tag/v0.5.1

@lfventura The new version now has a new argument to stop the SARIF re-writing.

Please try it out and let me know how it goes.

[Perdiga]

Still not working :( ... Let me know how I can help you to fix this

Downloading asset to "/github/workspace/.codeql/extractors/codeql-extractor-iac.tar.gz"
Fetching release by tag: v0.5.1
Release :: v0.5.1 - Some(2025-09-12T14:51:58Z)

...

Interpreting results.
  Analysis complete in 6.73 seconds
  Post-processing SARIF results
  Updating SARIF tool name with extractor information
  Updated SARIF file with extractor: IAC
  CodeQL Database LoC :: 0
  SARIF Output Path :: "/github/workspace/.codeql/results/iac-results.sarif"
  Analysis complete :: CodeQLDatabase { name: "poc-iac", path: "/github/workspace/.codeql/databases/db-iac", language: Primary('iac'), source: Some("/github/workspace"), repository: None, config: Some(CodeQLDatabaseConfig { source_location_prefix: Some("/github/workspace"), primary_language: "iac", baseline_lines_of_code: 0, unicode_newlines: false, column_kind: "utf8", creation_metadata: Some(CodeQLDatabaseConfigMetadata { sha: Some("3a64a2337dd9654761f9ed31d651ecb5484dcbdb"), cli_version: "2.23.0", creation_time: 2025-09-12T21:47:37.586223054Z }), build_mode: None, finalised: true }) }
All databases created and analyzed

...

Run find . -type f -name "iac-results.sarif"
  find . -type f -name "iac-results.sarif"
  shell: /usr/bin/bash -e {0}
./.codeql/results/iac-results.sarif

...

Run github/codeql-action/upload-sarif@v3
  with:
    checkout_path: /home/runner/work/poc-iac/poc-iac
    token: ***
    matrix: null
    wait-for-processing: true
  
Error: Input required and not supplied: sarif_file

My Workflow

name: "CodeQL IaC"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: "ubuntu-latest"
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize and Analyze IaC
        id: codeql_iac
        uses: advanced-security/codeql-extractor-iac@v0.5.1

      - name: Search for iac-results.sarif
        run: |
          find . -type f -name "iac-results.sarif"

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.codeql_iac.outputs.sarif }}

[GeekMasher]

Here is the workflow I have been using:

- name: Initialize and Analyze IaC
  id: codeql
  uses: advanced-security/codeql-extractor-iac@v0.5.1
  with:
    rewrite-sarif-tool-name: false   # leave the name as "CodeQL"

- name: "Upload SARIF file"
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ${{ steps.codeql.outputs.sarif_results }}

The output is called sarif_results which might be the issue.

You can also add this to your testing step:

- name: "SARIF test"
  env:
    SARIF_PATH: ${{ steps.codeql.outputs.sarif_results }}
  run: |
    echo " >>> $SARIF_PATH"
    ls -la $SARIF_PATH

[Perdiga]

It's still not working for me

name: "CodeQL IaC"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: "ubuntu-latest"
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize and Analyze IaC
        id: codeql
        uses: advanced-security/codeql-extractor-iac@v0.5.1
        with:
          rewrite-sarif-tool-name: false   # leave the name as "CodeQL"
          
      - name: "SARIF test"
        env:
          SARIF_PATH: ${{ steps.codeql.outputs.sarif_results }}
        run: |
          echo " >>> $SARIF_PATH"
          ls -la $SARIF_PATH
    
      - name: "Upload SARIF file"
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.codeql.outputs.sarif_results }}

0s
Run echo " >>> $SARIF_PATH"
  echo " >>> $SARIF_PATH"
  ls -la $SARIF_PATH
  shell: /usr/bin/bash -e {0}
  env:
    SARIF_PATH: 
 >>> 
total 40
drwxr-xr-x 6 runner runner  4096 Sep 17 18:04 .
drwxr-xr-x 3 runner runner  4096 Sep 17 18:03 ..
drwxr-xr-x 5 root   root    4096 Sep 17 18:04 .codeql
drwxr-xr-x 7 runner runner  4096 Sep 17 18:04 .git
drwxr-xr-x 3 runner runner  4096 Sep 17 18:04 .github
-rw-r--r-- 1 runner runner  1084 Sep 17 18:04 LICENSE
-rw-r--r-- 1 runner runner 10790 Sep 17 18:04 README.md
drwxr-xr-x 5 runner runner  4096 Sep 17 18:04 infrastructure

the sarif path should be ./.codeql/results , right ?

[GeekMasher]

@Perdiga yes, because of the Container requirement now the output is in the repository folder

[Perdiga]

The workflow that you send will not work because steps.codeql.outputs.sarif_results is not outputting .codeql/results. It's outputting ``.

When debugging, i have this

  Shutting down query evaluator.
  Interpreting results.
  Analysis complete in 7.00 seconds
  Post-processing SARIF results
  Skipping SARIF tool name update as per configuration
  CodeQL Database LoC :: 0
  SARIF Output Path :: "/github/workspace/.codeql/results/iac-results.sarif"
  Analysis complete :: CodeQLDatabase { name: "poc-iac", path: "/github/workspace/.codeql/databases/db-iac", language: Primary('iac'), source: Some("/github/workspace"), repository: None, config: Some(CodeQLDatabaseConfig { source_location_prefix: Some("/github/workspace"), primary_language: "iac", baseline_lines_of_code: 0, unicode_newlines: false, column_kind: "utf8", creation_metadata: Some(CodeQLDatabaseConfigMetadata { sha: Some("85f7e039d8e25a66068a8273e8f3e78890345806"), cli_version: "2.23.0", creation_time: 2025-09-18T18:12:59.710565410Z }), build_mode: None, finalised: true }) }
  ::endgroup::
All databases created and analyzed
##[debug]Docker Action run completed with exit code 0
##[debug]Set output sarif_results = .codeql/results
##[debug]Finished: run
##[debug]Evaluating: steps.extractor.outputs.sarif_results
##[debug]Evaluating Index:
##[debug]..Evaluating Index:
##[debug]....Evaluating Index:
##[debug]......Evaluating steps:
##[debug]......=> Object
##[debug]......Evaluating String:
##[debug]......=> 'extractor'
##[debug]....=> Object
##[debug]....Evaluating String:
##[debug]....=> 'outputs'
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'sarif_results'
##[debug]=> '.codeql/results'
##[debug]Result: '.codeql/results'
##[debug]Finishing: Initialize and Analyze IaC

0s
##[debug]Evaluating: steps.codeql.outputs.sarif_results
##[debug]Evaluating Index:
##[debug]..Evaluating Index:
##[debug]....Evaluating Index:
##[debug]......Evaluating steps:
##[debug]......=> Object
##[debug]......Evaluating String:
##[debug]......=> 'codeql'
##[debug]....=> Object
##[debug]....Evaluating String:
##[debug]....=> 'outputs'
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'sarif_results'
##[debug]=> null
##[debug]Result: null
##[debug]Evaluating condition for step: 'SARIF test'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: SARIF test
##[debug]Loading inputs
##[debug]Loading env
Run echo " >>> $SARIF_PATH"
##[debug]/usr/bin/bash -e /home/runner/work/_temp/de35e305-05e5-4d5e-8ea8-82bf2a59ebdb.sh
 >>> 

I think that is because steps.extractor.outputs.sarif_results is being set with the path, but extractor is not part of my workflow. I think that the advanced-security/codeql-extractor-iac@v0.5.1 is not outputting this to my workflow that way steps.codeql.outputs.sarif_results will always be null

[Perdiga]

Sorry, I found an error. I was using sarif_results, but the correct is sarif-results as you are defining here

outputs:
  sarif-results:
    description: >
      The path to the SARIF results file generated by the extractor.
    value: ${{ steps.extractor.outputs.sarif_results }}

I updated the documentation to fix this issue
#230