From f9e6247d43130097a126a548c1aa14706f3ad3f5 Mon Sep 17 00:00:00 2001 From: adrian adewunmi Date: Tue, 14 Jul 2026 07:32:49 +0100 Subject: [PATCH] ci(scorecard): fix workflow artifact handling --- .github/workflows/scorecard.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 92b6872b..ed05535e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,7 +32,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@4fae2f995a2bb2cfa3eb1f6359181ef7b9ce110b # v6.0.0 with: persist-credentials: false @@ -59,9 +59,10 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 + uses: actions/upload-artifact@v7 with: - name: SARIF file + # Use a simple, lowercase artifact name without spaces to avoid API validation + name: results-sarif path: results.sarif retention-days: 5 @@ -71,3 +72,20 @@ jobs: uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 with: sarif_file: results.sarif + + inspect-sarif: + name: Inspect SARIF artifact + needs: analysis + runs-on: ubuntu-latest + steps: + - name: "Download SARIF artifact" + uses: actions/download-artifact@v4 + with: + name: results-sarif + + - name: "List SARIF file" + run: | + echo "Downloaded files:" + ls -la || true + echo "If results.sarif is present, show basic info:" + file results.sarif || true