From f9e6247d43130097a126a548c1aa14706f3ad3f5 Mon Sep 17 00:00:00 2001 From: adrian adewunmi Date: Tue, 14 Jul 2026 07:32:49 +0100 Subject: [PATCH 1/4] ci(scorecard): fix workflow artifact handling --- .github/workflows/scorecard.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 92b6872b..ed05535e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,7 +32,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@4fae2f995a2bb2cfa3eb1f6359181ef7b9ce110b # v6.0.0 with: persist-credentials: false @@ -59,9 +59,10 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 + uses: actions/upload-artifact@v7 with: - name: SARIF file + # Use a simple, lowercase artifact name without spaces to avoid API validation + name: results-sarif path: results.sarif retention-days: 5 @@ -71,3 +72,20 @@ jobs: uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 with: sarif_file: results.sarif + + inspect-sarif: + name: Inspect SARIF artifact + needs: analysis + runs-on: ubuntu-latest + steps: + - name: "Download SARIF artifact" + uses: actions/download-artifact@v4 + with: + name: results-sarif + + - name: "List SARIF file" + run: | + echo "Downloaded files:" + ls -la || true + echo "If results.sarif is present, show basic info:" + file results.sarif || true From 9eb52f5d1cdab6396505c607e7c2d5f82b8119a7 Mon Sep 17 00:00:00 2001 From: adrian adewunmi Date: Tue, 14 Jul 2026 07:57:24 +0100 Subject: [PATCH 2/4] ci(scorecard): pin actions/checkout to v6.0.0 commit SHA --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ed05535e..7d446e17 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,7 +32,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@4fae2f995a2bb2cfa3eb1f6359181ef7b9ce110b # v6.0.0 + uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ffd01eeb3 # v6.0.0 with: persist-credentials: false From f9b5ba74a4d784a2fe85cccf3342479e878683c9 Mon Sep 17 00:00:00 2001 From: Adrian Adewunmi Date: Thu, 16 Jul 2026 08:28:42 +0100 Subject: [PATCH 3/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 7d446e17..64ce85f3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -87,5 +87,5 @@ jobs: run: | echo "Downloaded files:" ls -la || true - echo "If results.sarif is present, show basic info:" - file results.sarif || true + echo "If results-sarif/results.sarif is present, show basic info:" + file results-sarif/results.sarif || true From d95feffbca170b40a51ae765f40d2239fc23dbf8 Mon Sep 17 00:00:00 2001 From: adrian adewunmi Date: Thu, 16 Jul 2026 08:34:31 +0100 Subject: [PATCH 4/4] ci(scorecard): fix workflow artifact handling and pin action SHAs --- .github/workflows/scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 64ce85f3..fbe3fd2d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -59,7 +59,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: # Use a simple, lowercase artifact name without spaces to avoid API validation name: results-sarif @@ -79,7 +79,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Download SARIF artifact" - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 with: name: results-sarif