Skip to content

Conversation

@p4r53c
Copy link
Contributor

@p4r53c p4r53c commented Aug 26, 2025

Summary

This PR adds support for GitHub Enterprise Server when uploading code scanning SARIF:

  1. New action inputs: ghe-base-url (and alias ghe_base_url).
  2. uploadCodeScanningSarif now uses @actions/github.getOctokit(token, { baseUrl }).
    • If ghe[-_]base_url is provided, it is used.
    • Otherwise, the default GHES API base URL is auto-detected by @actions/github on self-hosted runners.

Why

Octokit requires an explicit baseUrl to talk to GHES REST API; otherwise it targets api.github.com.
Using @actions/github.getOctokit aligns with other official actions and preserves GHES proxy settings.

Notes

  • Target branch: master.
  • Built TypeScript and committed lib/ accordingly.
  • Added tests for baseUrl selection (explicit input vs. auto GHES).

@github-actions
Copy link


Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.


I have read the CLA Document and I hereby sign the CLA


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

const octokit = new core_1.Octokit({ auth: token });
let response;
response = yield octokit.request('POST /repos/{owner}/{repo}/code-scanning/sarifs', {
var _a, _b, _c;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adjust variable naming

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also variable declaration can be moved closer to usage

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its lib code and generated by the compiler

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right sry

const octokit: Octokit = new Octokit({ auth: token });
let response: OctokitResponse<any> | undefined;
response = await octokit.request('POST /repos/{owner}/{repo}/code-scanning/sarifs', {
const inputBaseUrl = core.getInput('ghe-base-url', { required: false }) || core.getInput('ghe_base_url', { required: false }) || '';
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why support both conventions ? "-" and "_" ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the sake of compatibility, errors may occur.

@RemiBou RemiBou merged commit d814d84 into jfrog:master Aug 26, 2025
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants