CodeQL CLI --ref option

[sam-cha-tfs]

In our CI/CD we are not using actions. Instead we use the CLI commands to create and analyze the database for a project. In the final step we have to upload the sarif file to GitHub. How do we get the name of the ref we are analyzing? On a push it seems pretty straight forward that the ref is just refs/heads/BRANCH-NAME but what about a merge?

[cannist]

If you're talking about a pull request context then you can use the ref refs/pull/NUMBER/head for the branch but using the normal refs/heads/BRANCH_NAME works equally. Here, NUMBER is the number of the pull request.

For the merge it would be refs/pull/NUMBER/merge.

Note, though, that full integration of the results into the PR (where annotations for found alerts are put into the diff) might possibly only work if GitHub actually knows the merge commit. So if you create a merge commit locally you might not see annotations because the code scanning logic is looking for a different commit sha than the one you provided.

I think you should be able to get data about these refs via git ls-remote which should also tell you the sha that GitHub is looking for.

[sam-cha-tfs]

Would using git ls-remote show the pull req number?

[cannist]

It would show you all the refs for the repo but that would not help you in knowing which one corresponds to the one you're analyzing. Ideally your CI setup would have enough information in the context to determine the pull request.

You could get away with uploading the results and just claim it was for the branch head (using the branch ref and the head commit sha) even though you analyzed the merge if that is easier for you.

[sam-cha-tfs]

Does this imply that refs/pull/NUMBER/head and refs/heads/BRANCH_NAME are the same??

[cannist]

Does this imply that refs/pull/NUMBER/head and refs/heads/BRANCH_NAME are the same??

They are two different refs that point to the same commit, yes.