Skip to content

Commit abe17b5

Browse files
jsorefjsoref
committed
Use GITHUB_WORKFLOW_REF
Introduced with GHES 3.9: https://docs.github.com/en/enterprise-server@3.9/actions/learn-github-actions/variables GITHUB_WORKFLOW_REF means that actions don't need to use `actions: read` to determine the path to the running workflow.
1 parent b1bd8da commit abe17b5

File tree

5 files changed

+16
-35
lines changed

5 files changed

+16
-35
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Note that the only difference between `v2` and `v3` of the CodeQL Action is the
66

77
## [UNRELEASED]
88

9-
No user facing changes.
9+
- Users will no longer need to include `actions: read` permissions to use `upload-sarif` in private repositories.
1010

1111
## 3.25.6 - 20 May 2024
1212

‎lib/api-client.js

Lines changed: 5 additions & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/api-client.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎queries/default-setup-environment-variables.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,9 @@ predicate isSafeForDefaultSetup(string envVar) {
2222
"GITHUB_ACTION_REF", "GITHUB_ACTION_REPOSITORY", "GITHUB_ACTOR", "GITHUB_API_URL",
2323
"GITHUB_BASE_REF", "GITHUB_EVENT_NAME", "GITHUB_JOB", "GITHUB_RUN_ATTEMPT", "GITHUB_RUN_ID",
2424
"GITHUB_SHA", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITHUB_TOKEN", "GITHUB_WORKFLOW",
25-
"GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS", "RUNNER_ARCH",
26-
"RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE"
25+
"GITHUB_WORKFLOW_REF", "GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS",
26+
"RUNNER_ARCH", "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP",
27+
"RUNNER_TOOL_CACHE"
2728
]
2829
}
2930

‎src/api-client.ts

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -121,25 +121,12 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {
121121
* Get the path of the currently executing workflow relative to the repository root.
122122
*/
123123
export async function getWorkflowRelativePath(): Promise<string> {
124-
const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
125-
const owner = repo_nwo[0];
126-
const repo = repo_nwo[1];
127-
const run_id = Number(getRequiredEnvParam("GITHUB_RUN_ID"));
128-
129-
const apiClient = getApiClient();
130-
const runsResponse = await apiClient.request(
131-
"GET /repos/:owner/:repo/actions/runs/:run_id?exclude_pull_requests=true",
132-
{
133-
owner,
134-
repo,
135-
run_id,
136-
},
137-
);
138-
const workflowUrl = runsResponse.data.workflow_url;
139-
140-
const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
141-
142-
return workflowResponse.data.path;
124+
const workflow_ref = process.env["GITHUB_WORKFLOW_REF"];
125+
const workflowRegExp = new RegExp("^[^/]+/[^/]+/(.*?)@.*");
126+
const match = workflow_ref?.match(workflowRegExp);
127+
return new Promise((resolve) => {
128+
resolve(match ? match[1] : '');
129+
});
143130
}
144131

145132
/**

0 commit comments

Comments
 (0)