Sarif Upload Does not work from docker container

[FaiqueAli]

Sarif Upload failed from container

I am trying to upload .sarif file from a windows docker container by using PAT to a github private repo.
my Codeql CLI upload command from a container is

RUN codeql github upload-results --repository=abc/xyz --ref=refs/heads/xxx --commit=xxx --sarif=C:\\xyz\\result.sarif --github-url=https://PAT@github.com/abc/ --github-auth-stdin

while this command is working perfectly from the local server (not docker)
but when I execute the same inside a container I got the following error..

IllegalStateException: Standard input stream is empty while processing argument at or before arg[5] '-a' in [--repository=abc/xyz, --ref=refs/heads/xxx, --commit=xxx, --sarif=C:\\xyz\\result.sarif, --github-url=https://PAT@github.com/abc/, -a]: java.lang.IllegalStateException: Standard input stream is empty
Try codeql github upload-results --help for usage help.

does anyone let me know what I am doing wrong?

Thanks :)

[aibaars]

codeql github upload-results --help
Usage: codeql github upload-results [OPTIONS]
Uploads a SARIF file to GitHub code scanning.

See: https://docs.github.com/en/code-security/secure-coding/running-codeql-cli-in-your-ci-system#uploading-results-to-github

A GitHub Apps token or personal access token must be set. For best security practices, it is
recommended to set the --github-auth-stdin flag and pass the token to the command through
standard input. Alternatively, the GITHUB_TOKEN environment variable can be set.

This token must have the security_events scope.

I think the easiest thing to do would be to set the GITHUB_TOKEN environment variable.

Alternatively you could store the token in a file and "pipe" it into the codeql command; something like:

RUN type C:\\xyz\\my-token.txt | codeql github upload-results --repository=abc/xyz --ref=refs/heads/xxx --commit=xxx --sarif=C:\\xyz\\result.sarif --github-url=https://github.com/abc/ --github-auth-stdin

[FaiqueAli]

How can I get rid of --github-auth-stdin as it will prompt to enter value but I need to automate the process inside GitHub actions?
I just want to provide ${{secrets.xxx}} (personal access token) inside a workflow.
the other option available in the codeql help is --github-url=<url>, could you please explain how can I utilize this to use my Personal access token in a workflow..

[aibaars]

Removing --github-auth-stdin and setting the GITHUB_TOKEN=[YOUR PAT] environment variable should work. See also https://codeql.github.com/docs/codeql-cli/manual/github-upload-results/#description

[FaiqueAli]

I am executing the below command in a workflow

docker exec -w C:\\xxx [containerId] codeql github upload-results --reposotory=name-of-repo/xxx --sarif=sarifPath 
--ref=branchname --github-url=http://github.com

I got an error

A fatal error occurred: A GitHub token is required to upload SARIF results but none was specified.
(eventual cause: MissingTokenException "An operation was attempted that requires a GitHub token but one could not be fou...")

So, this is a simple container call in which I inject my codeql command to execute inside docker where codeql CLI is installed and .sarif file is stored.

I think there is no need for env_variable here. I need a way to put my PAT along with the command.

[aibaars]

Have you tried:

docker exec -w C:\\xxx -e GITHUB_TOKEN=[YOUR_PAT] [containerId] codeql github upload-results --repository=name-of-repo/xxx --sarif=sarifPath 
--ref=branchname --github-url=http://github.com

That should set the GITHUB_TOKEN in the container to "YOUR_PAT" so codeql upload-results can find it.

[FaiqueAli]

By execution of this

docker exec -w C:\\xxx -e GITHUB_TOKEN=[YOUR_PAT] [containerId] codeql github upload-results --repository=name-of-repo/xxx --sarif=sarifPath 
--ref=branchname --github-url=http://github.com

or this

docker exec -w C:\\xxx [containerId] codeql github upload-results --repository=name-of-repo/xxx --sarif=sarifPath 
--ref=branchname -a=[GIT_PAT]

I got this..

A fatal error occurred: Error encountered during upload.
(eventual cause: UnknownHostException "This is usually a temporary error during hostname resolution and means that the ...")

[aibaars]

That is probably a network issue (in docker?) on your end. Is github.com reachable from within the container? If you increase verbosity (-vvv) then the log should provide more information.

Also, it is better to use https instead of http . Note that it should be possible to leave out --github-url=http://github.com because https://github.com/ is the default value.

[FaiqueAli]

There is no information regarding git or upload in the log file. I did not provide --github-url=http://github.com flag, and yes I am using https instead of http.
Do I need to install git inside the container?

[aibaars]

@FaiqueAli did you add the -vvv flag? Could you also try --loglevel=TRACE and --log-to-stderr ?

There should be no need to have git installed in the container, although it is worth a try.

Have you double checked network connection settings in the container? Can you reach external websites? A command like curl https://github.com should work as a quick test (assuming you have curl.exe on your system, which I think installed by default on Windows 10+).

[FaiqueAli]

Now I executed it again with the simple command.

docker exec -w C:\\xxx [containerId] codeql github upload-results --repository=name-of-repo/xxx --sarif=sarifPath 
--ref=branchname -a=[GIT_PAT]

and finally, the file has been uploaded to Github from my container.
but I need to be sure It will also upload in the prod environment and not cause any issue.
some more tips in this regards will also be helpful.

Thanks :)

[aibaars]

That's great news. Things should work just fine in the production environment too, unless your production environment has network settings or a firewall that prevent uploads to github.com .

I'm closing this issue, because you were able to upload a SARIF file from your docker container.

Please create a new issue if you run into additional problems.

[FaiqueAli]

Yes thank you very much for your time and valuable support :)