Favor GITHUB_WORKFLOW_REF

Introduced with GHES 3.9: https://docs.github.com/en/[email protected]/actions/learn-github-actions/variables GITHUB_WORKFLOW_REF means that actions don't need to use `actions: read` to determine the path to the running workflow.
github · Feb 13, 2024 · b66391a · b66391a
1 parent c79c360
commit b66391a
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,7 @@ Note that the only difference between `v2` and `v3` of the CodeQL Action is the
 
 - Update default CodeQL bundle version to 2.16.2. [#2124](https://github.com/github/codeql-action/pull/2124)
 - The CodeQL action no longer fails if it can't write to the telemetry api endpoint. [#2121](https://github.com/github/codeql-action/pull/2121)
+- Users of GHES3.9+ and GHEC will no longer need to include `actions: read` permissions to use `upload-sarif` in private repositories.
 
 ## 3.24.0 - 02 Feb 2024
 

diff --git a/lib/api-client.js b/lib/api-client.js
diff --git a/lib/api-client.js.map b/lib/api-client.js.map
diff --git a/src/api-client.ts b/src/api-client.ts
@@ -119,6 +119,18 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {
  * Get the path of the currently executing workflow relative to the repository root.
  */
 export async function getWorkflowRelativePath(): Promise<string> {
+  const workflow_ref = process.env["GITHUB_WORKFLOW_REF"];
+  // When GHES 3.8 support is removed, this if guard and its corresponding
+  // fallback code can be removed.
+  if (workflow_ref !== undefined) {
+    const workflowRegExp = new RegExp("^[^/]+/[^/]+/(.*?)@.*");
+    const match = workflow_ref.match(workflowRegExp);
+    if (match) {
+      return new Promise((resolve) => {
+        resolve(match[1]);
+      });
+    }
+  }
   const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
   const owner = repo_nwo[0];
   const repo = repo_nwo[1];