Skip to content

fix(scorecard): never let a reconciler failure skip the SARIF upload #781

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Sep 14, 2026
Merged

fix(scorecard): never let a reconciler failure skip the SARIF upload #781

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c27611f
fix(scorecard): never let a reconciler failure skip the SARIF upload
hyperpolymath Sep 14, 2026
32c69ed
Merge branch 'main' into secqual/scorecard-reconcile-fail-open
hyperpolymath Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 66 additions & 2 deletions .github/workflows/scorecard-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,17 +55,40 @@ jobs:
sparse-checkout: scripts/reconcile-scorecard-actions-lock.rb
sparse-checkout-cone-mode: false
- name: Reconcile native action pins
id: reconcile
# Fail open on the ARTEFACT, never on the outcome. Previously this step
# ran under `set -euo pipefail` with no `continue-on-error`, and the
# upload below consumed results.reconciled.sarif. Any reconciler failure
# therefore skipped the upload entirely, and code scanning silently kept
# serving the PREVIOUS scan's alerts behind a green badge. That is the
# same shape as the ~2-month freeze recorded above (PR #393).
# The upload is now unconditional; the run still fails, at the end of
# the job, once the results are safely published.
continue-on-error: true
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
gh extension install github/gh-actions-lock --pin v0.1.6
ruby .standards-scorecard/scripts/reconcile-scorecard-actions-lock.rb \
results.sarif results.reconciled.sarif actions-lock-audit.json

- name: Select SARIF to upload
id: select-sarif
run: |
set -euo pipefail
if [ -s results.reconciled.sarif ]; then
printf 'file=%s\n' results.reconciled.sarif >> "$GITHUB_OUTPUT"
printf 'reconciled=true\n' >> "$GITHUB_OUTPUT"
else
echo "::warning title=Scorecard reconciliation produced no SARIF::Uploading raw results.sarif. Native action pins will appear UNRECONCILED in this upload."
printf 'file=%s\n' results.sarif >> "$GITHUB_OUTPUT"
printf 'reconciled=false\n' >> "$GITHUB_OUTPUT"
fi
- name: Upload SARIF to code scanning
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
with:
sarif_file: results.reconciled.sarif
sarif_file: ${{ steps.select-sarif.outputs.file }}

- name: Upload results artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
Expand All @@ -77,6 +100,15 @@ jobs:
actions-lock-audit.json
retention-days: 90

# The upload above can no longer be skipped, so a reconciler outage cannot
# freeze this repo's Security tab. A failed reconciliation is still a
# failure, and is surfaced here rather than swallowed.
- name: Fail if reconciliation did not succeed
if: "!cancelled() && (steps.reconcile.outcome != 'success' || steps.select-sarif.outputs.reconciled != 'true')"
run: |
echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}'. Raw SARIF was uploaded so results are not lost, but this run fails by design."
exit 1

pull-request:
if: github.event_name == 'pull_request'
name: Run Scorecard PR
Expand Down Expand Up @@ -156,17 +188,40 @@ jobs:
sparse-checkout: scripts/reconcile-scorecard-actions-lock.rb
sparse-checkout-cone-mode: false
- name: Reconcile native action pins
id: reconcile
# Fail open on the ARTEFACT, never on the outcome. Previously this step
# ran under `set -euo pipefail` with no `continue-on-error`, and the
# upload below consumed results.reconciled.sarif. Any reconciler failure
# therefore skipped the upload entirely, and code scanning silently kept
# serving the PREVIOUS scan's alerts behind a green badge. That is the
# same shape as the ~2-month freeze recorded above (PR #393).
# The upload is now unconditional; the run still fails, at the end of
# the job, once the results are safely published.
continue-on-error: true
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
gh extension install github/gh-actions-lock --pin v0.1.6
ruby .standards-scorecard/scripts/reconcile-scorecard-actions-lock.rb \
results.sarif results.reconciled.sarif actions-lock-audit.json

- name: Select SARIF to upload
id: select-sarif
run: |
set -euo pipefail
if [ -s results.reconciled.sarif ]; then
printf 'file=%s\n' results.reconciled.sarif >> "$GITHUB_OUTPUT"
printf 'reconciled=true\n' >> "$GITHUB_OUTPUT"
else
echo "::warning title=Scorecard reconciliation produced no SARIF::Uploading raw results.sarif. Native action pins will appear UNRECONCILED in this upload."
printf 'file=%s\n' results.sarif >> "$GITHUB_OUTPUT"
printf 'reconciled=false\n' >> "$GITHUB_OUTPUT"
fi
- name: Upload SARIF to code scanning
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
with:
sarif_file: results.reconciled.sarif
sarif_file: ${{ steps.select-sarif.outputs.file }}
- name: Retain scan evidence
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
Expand All @@ -177,3 +232,12 @@ jobs:
actions-lock-audit.json
if-no-files-found: error
retention-days: 14

# The upload above can no longer be skipped, so a reconciler outage cannot
# freeze this repo's Security tab. A failed reconciliation is still a
# failure, and is surfaced here rather than swallowed.
- name: Fail if reconciliation did not succeed
if: "!cancelled() && (steps.reconcile.outcome != 'success' || steps.select-sarif.outputs.reconciled != 'true')"
run: |
echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}'. Raw SARIF was uploaded so results are not lost, but this run fails by design."
exit 1
Loading