ref not found in this repository

[ianlewis]

When running GitHub actions PR checks in the merge queue I get an error message.

Uploading results
  Processing sarif files: ["/home/runner/work/slsa-github-generator/results/go.sarif"]
  Uploading results
  Error: ref 'refs/heads/gh-readonly-queue/main/pr-1804-67d80537cd2bc6f8a811283cdee52752c3aa52a2' not found in this repository

Here is a job run for reference: https://github.com/slsa-framework/slsa-github-generator/actions/runs/4400573949/jobs/7705996656

[ianlewis]

Perhaps related to #1537

[rneatherway]

That's correct. We are discussing internally how best to support merge queue. Any information that you have about your use-case would be interesting!

[ianlewis]

That's correct. We are discussing internally how best to support merge queue. Any information that you have about your use-case would be interesting!

I think our use case is pretty straightforward. We have a (mostly) unmodified CodeQL workflow that we'd like to run and block a merge (via branch protection rules) when there are issues.

[rneatherway]

Thanks, would you say that your main problem is:

1. You cannot currently use merge queue and branch protection rules for CodeQL at the same time, which means you cannot have CodeQL as a required check for PRs.
2. You are concerned about catching additional vulnerabilities in the merge queue runs specifically.

[ianlewis]

Thanks, would you say that your main problem is:

1. You cannot currently use merge queue and branch protection rules for CodeQL at the same time, which means you cannot have CodeQL as a required check for PRs.
2. You are concerned about catching additional vulnerabilities in the merge queue runs specifically.

Yeah, we want to make sure that all of our pre-submits run successfully at HEAD before merging. We're a security focused project so we are more strict than most about it.

[rneatherway]

Yeah, we want to make sure that all of our pre-submits run successfully at HEAD before merging. We're a security focused project so we are more strict than most about it.

That makes sense 👍. Were you previously using the "Require branches to be up to date before merging" setting?

[ianlewis]

Yes, we are currently using that setting right now but it makes updating dependencies really time consuming so we'd like to try to solve it by using the merge queue feature.

[rneatherway]

Understood, thanks. That particular point of view is useful to know about.

[matthimatik]

Any updates on this? We weren't aware of this issues and we actually didn't had any problems with it. But 3 days ago (Dec 17, 2024, 8:43 AM GMT+1) a CodeQL check in the merge queue failed for the first time.

ref 'refs/heads/gh-readonly-queue/main/pr-3174-9de2a9f1ca3bfa6b84bf709610e8d84ebdd21eec' not found in this repository

Is there still no support for CodeQL in merge queues and does anyone have an explanation why we didn't had problems with that until recently (Dec 17, 2024, 8:43 AM GMT+1)?

[matthimatik]

Might be related to: https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/

[maxdeichmann]

@rneatherway what is the best workaround here? I would like to upload the results form my snyk run to GitHub (https://github.com/snyk/actions/tree/master/node#uploading-snyk-scan-results-to-github-code-scanning) which fails with the above error. Is there any fix planned?