From 00499095d6ca926eb92eb993b29be2d167f78898 Mon Sep 17 00:00:00 2001 From: Scot Breitenfeld Date: Tue, 7 Apr 2026 06:51:12 -0600 Subject: [PATCH] ci: only upload empty SARIF for pull_request events (#6353) Restrict empty SARIF upload to pull_request events only, so that push-to-develop (e.g. after merging a text-only PR) does not overwrite the real CodeQL results in the Security tab with an empty SARIF. --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8ca3170d83a..0a96a8a87a7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -236,7 +236,7 @@ jobs: fi - name: Create empty SARIF file - if: needs.analyze.result == 'skipped' + if: needs.analyze.result == 'skipped' && github.event_name == 'pull_request' run: | cat <<'EOF' > "${{ github.workspace }}/empty.sarif" { @@ -250,7 +250,7 @@ jobs: EOF - name: Upload empty SARIF for skipped analysis - if: needs.analyze.result == 'skipped' + if: needs.analyze.result == 'skipped' && github.event_name == 'pull_request' uses: github/codeql-action/upload-sarif@e34fc2711fb7964ca6850c8a8382121f34745f3b # v4.32.4 with: sarif_file: ${{ github.workspace }}/empty.sarif