C#: Port the java FrameworkCoverage query.

[michaelnebel]

In this PR we

• Port the Java FrameworkCoverage query to C#.
• Include the generation in the "publish" workflow (like for java).

[michaelnebel]

@henrymercer : I have just ported the java Framework Coverage query to C# and included the generation of the sarif in the workflow. Do you know, there is some other functionality around that reads the sarif output files (the artifacts) from the workflow execution or is it just for manual downloading? :-) Anything you know about this would help :-)

[henrymercer]

Hi @michaelnebel 👋 The ingestion into the data warehouse happens via the github/codeql-action/upload-sarif Action — that Action uploads the SARIF file to a GitHub API endpoint which processes it and adds the relevant data to the data warehouse. Happy to follow up on an internal issue with more details about how that works.

My understanding is that the workflow artifact created by actions/upload-artifact is purely for debugging.

[michaelnebel]

Hi @michaelnebel 👋 The ingestion into the data warehouse happens via the github/codeql-action/upload-sarif Action — that Action uploads the SARIF file to a GitHub API endpoint which processes it and adds the relevant data to the data warehouse. Happy to follow up on an internal issue with more details about how that works.

My understanding is that the workflow artifact created by actions/upload-artifact is purely for debugging.

Aha, that is good to know! And thank you very much for helping out! 😄
I will take the liberty to assign you on the PR (let me know if this is not ok).

I just to a brief look at the source code for the codeql-action/upload-sarif, but couldn't really figure out, whether changing the name of the sarif file for the existing Java reporting will have other side-effects somewhere downstream or if it is only the content of the file that matters (which should be identical to before).
So basically my questions are, do you know whether
(1) The file name matters downstream in the processing.
(2) Exactly where the data will end up.

If we can verify that (1) does not cause in problems, then the PR can probably be merged almost as is.

[henrymercer]

Aha, that is good to know! And thank you very much for helping out! 😄
I will take the liberty to assign you on the PR (let me know if this is not ok).

No problem!

So basically my questions are, do you know whether
(1) The file name matters downstream in the processing.

The file name doesn't matter for the processing — only its content.

(2) Exactly where the data will end up.

I've answered this on the internal issue.

[hvitved]

Looks plausible to me.

[michaelnebel]

Needed to rebase due to a merge conflict (update of the action upload-artifact to v3).