Skip to content

Commit 7a76543

Browse files
committed
Only delete SARIF in PR check if not running on a fork
The `Submit SARIF after failure` PR Check was failing when opened on a fork because of a permissions problem when deleting the uploaded SARIF. This change should fix this by only deleting the SARIF when the owner of the current repository is `github`.
1 parent 9653106 commit 7a76543

3 files changed

+16
-3
lines changed

lib/init-action-post-helper.js

+6-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/init-action-post-helper.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/init-action-post-helper.ts

+9-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
import * as core from "@actions/core";
2+
13
import * as actionsUtil from "./actions-util";
24
import { getApiClient } from "./api-client";
35
import { getCodeQL } from "./codeql";
@@ -182,7 +184,13 @@ export async function run(
182184
);
183185
}
184186

185-
if (process.env["CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF"] === "true") {
187+
core.info(`GITHUB_ACTOR is ${process.env["GITHUB_ACTOR"]}`);
188+
// We do not delete uploaded SARIFs if we're on a fork, as we're missing the
189+
// appropriate permissions.
190+
if (
191+
process.env["CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF"] === "true" &&
192+
repositoryNwo.owner !== "github"
193+
) {
186194
await removeUploadedSarif(uploadFailedSarifResult, logger);
187195
}
188196

0 commit comments

Comments
 (0)