[Bug]: The action raised an error when there is no analysis

[adrienpessu]

What happened?

This issue has been raised by a customer. The policy-as-code action has been configured as a required workflow at the organisation level. For the repositories that have languages not compatible with CodeQL, the action return a 404 and make it an unacceptable threshold risk.

Version

v2 (current major version)

Where are you experiencing the issue?

GitHub Actions

Relevant log output

2024-11-05T09:05:24.8621541Z Current runner version: '2.320.0'
2024-11-05T09:05:24.8630781Z Runner name: 'ubuntu-latest_9b2ced0693cf'
2024-11-05T09:05:24.8632016Z Runner group name: 'Default'
2024-11-05T09:05:24.8633359Z Machine name: 'runner'
2024-11-05T09:05:24.8658329Z ##[group]Operating System
2024-11-05T09:05:24.8659362Z Ubuntu
2024-11-05T09:05:24.8660001Z 22.04.5
2024-11-05T09:05:24.8661095Z LTS
2024-11-05T09:05:24.8661839Z ##[endgroup]
2024-11-05T09:05:24.8662727Z ##[group]Runner Image
2024-11-05T09:05:24.8663566Z Image: ubuntu-22.04
2024-11-05T09:05:24.8664410Z Version: 20241015.1.0
2024-11-05T09:05:24.8666408Z Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20241015.1/images/ubuntu/Ubuntu2204-Readme.md
2024-11-05T09:05:24.8669117Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20241015.1
2024-11-05T09:05:24.8670625Z ##[endgroup]
2024-11-05T09:05:24.8692042Z ##[group]GITHUB_TOKEN Permissions
2024-11-05T09:05:24.8694812Z Checks: read
2024-11-05T09:05:24.8695768Z Contents: read
2024-11-05T09:05:24.8696845Z Metadata: read
2024-11-05T09:05:24.8697577Z PullRequests: write
2024-11-05T09:05:24.8698370Z SecurityEvents: read
2024-11-05T09:05:24.8699388Z ##[endgroup]
2024-11-05T09:05:24.8704440Z Secret source: Actions
2024-11-05T09:05:24.8705454Z Prepare workflow directory
2024-11-05T09:05:24.9622649Z Prepare all required actions
2024-11-05T09:05:24.9778401Z Getting action download info
2024-11-05T09:05:25.1371312Z Download action repository 'advanced-security/[email protected]' (SHA:c5dff3b33e49176359f48b91c3d3906be0eaee7b)
2024-11-05T09:05:25.6911863Z Complete job name: compliance
2024-11-05T09:05:25.8215784Z ##[group]Run advanced-security/[email protected]
2024-11-05T09:05:25.8216983Z with:
2024-11-05T09:05:25.8217772Z policy: DevExpPlatform/required-workflows
2024-11-05T09:05:25.8219073Z policy-path: policies/default.yaml
2024-11-05T09:05:25.8220026Z policy-branch: main
2024-11-05T09:05:25.8223372Z token: ***
2024-11-05T09:05:25.8224198Z ref: main
2024-11-05T09:05:25.8224843Z severity: error
2024-11-05T09:05:25.8225953Z repository: DevExpPlatform/crossplane-project
2024-11-05T09:05:25.8227427Z action: break
2024-11-05T09:05:25.8228300Z retries: 240
2024-11-05T09:05:25.8229053Z ##[endgroup]
2024-11-05T09:05:25.8751544Z ##[group]Run echo "Running Policy as Code..."
2024-11-05T09:05:25.8752956Z �[36;1mecho "Running Policy as Code..."�[0m
2024-11-05T09:05:25.8755738Z �[36;1mexport PYTHONPATH=/home/runner/work/actions/advanced-security/policy-as-code/v2.9.0:/home/runner/work/actions/advanced-security/policy-as-code/v2.9.0/vendor�[0m
2024-11-05T09:05:25.8758734Z �[36;1mpython3 -m ghascompliance \�[0m
2024-11-05T09:05:25.8759747Z �[36;1m --severity "error" \�[0m
2024-11-05T09:05:25.8760655Z �[36;1m --action "break" \�[0m
2024-11-05T09:05:25.8762841Z �[36;1m --github-token "***" \�[0m
2024-11-05T09:05:25.8763905Z �[36;1m --policy-repo-token "" \�[0m
2024-11-05T09:05:25.8765398Z �[36;1m --github-repository "DevExpPlatform/crossplane-project" \�[0m
2024-11-05T09:05:25.8766865Z �[36;1m --github-ref "main" \�[0m
2024-11-05T09:05:25.8768191Z �[36;1m --github-policy "DevExpPlatform/required-workflows" \�[0m
2024-11-05T09:05:25.8769812Z �[36;1m --github-policy-path "policies/default.yaml" \�[0m
2024-11-05T09:05:25.8771266Z �[36;1m --github-policy-branch "main" \�[0m
2024-11-05T09:05:25.8772356Z �[36;1m --retry-count "240" \�[0m
2024-11-05T09:05:25.8773296Z �[36;1m �[0m
2024-11-05T09:05:25.9085173Z shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
2024-11-05T09:05:25.9086455Z ##[endgroup]
2024-11-05T09:05:25.9707437Z Running Policy as Code...
2024-11-05T09:05:26.3657721Z INFO:root:GitHub Repository :: DevExpPlatform/crossplane-project
2024-11-05T09:05:26.3670533Z INFO:root:GitHub Instance :: https://github.com
2024-11-05T09:05:26.3671947Z INFO:root:GitHub Reference (branch/pr) :: main
2024-11-05T09:05:26.3673935Z INFO:root:Loading Policy as Code from Repository - https://github.com/DevExpPlatform/required-workflows/policies/default.yaml
2024-11-05T09:05:26.3676215Z INFO:root:Cloning policy repo - DevExpPlatform/required-workflows@main
2024-11-05T09:05:27.1451949Z INFO:root:Loading policy file - /tmp/repo/policies/default.yaml
2024-11-05T09:05:27.1452997Z INFO:root:Policy loaded successfully
2024-11-05T09:05:27.1453862Z INFO:root:Saving Policy...
2024-11-05T09:05:27.1454646Z INFO:root:Policy saved
2024-11-05T09:05:27.1455549Z INFO:root:Finished loading policy
2024-11-05T09:05:27.1456300Z INFO:root:Policy as Code Summary:
2024-11-05T09:05:27.1457061Z INFO:root: 2024-11-05T09:05:27.1458022Z INFO:root:general: 'high' 2024-11-05T09:05:27.1458936Z INFO:root:codescanning: 'high' 2024-11-05T09:05:27.1459892Z INFO:root:dependabot: 'high' 2024-11-05T09:05:27.1460949Z INFO:root:licensing: 'high' 2024-11-05T09:05:27.1461926Z INFO:root:dependencies: 'high' 2024-11-05T09:05:27.1462937Z INFO:root:secretscanning: 'high' 2024-11-05T09:05:27.1463686Z INFO:root:
2024-11-05T09:05:27.3308973Z ERROR:ghastoolkit.octokit:Error code from server :: 404
2024-11-05T09:05:27.3310147Z _____ _ _ ___ _____ _____ _ _
2024-11-05T09:05:27.3312262Z ERROR:root:Unknown Exception was hit, please repo this to https://github.com/advanced-security/policy-as-code
2024-11-05T09:05:27.3314744Z ERROR:root:Not Found (status code: 404)
2024-11-05T09:05:27.3315659Z | __ | | | | / _ \ / / __ \ | ()
2024-11-05T09:05:27.3317117Z | | /| || |/ /\ \ --.| / \/ ___ _ __ ___ _ __ | |_ __ _ _ __ ___ ___ 2024-11-05T09:05:27.3318810Z | | __ | _ || _ | --. \ | / _ | ' _ \| '_ \| | |/ _ | ' \ / / _
2024-11-05T09:05:27.3319650Z | |\ | | | || | | |/_/ / _/\ () | | | | | | |) | | | (| | | | | (| /
2024-11-05T09:05:27.3320592Z _/_| |/_| |/_/ _/_/|| || || .__/|||_,|| ||__|
2024-11-05T09:05:27.3321195Z | |
2024-11-05T09:05:27.3321758Z || v2.9.0
2024-11-05T09:05:27.3322461Z GitHub Advanced Security Policy as Code by GeekMasher
2024-11-05T09:05:27.3322807Z
2024-11-05T09:05:27.3323122Z GitHub Repository :: DevExpPlatform/crossplane-project
2024-11-05T09:05:27.3323665Z GitHub Instance :: https://github.com
2024-11-05T09:05:27.3324204Z GitHub Reference (branch/pr) :: main
2024-11-05T09:05:27.3332934Z ##[group]Policy as Code
2024-11-05T09:05:27.3334687Z Loading Policy as Code from Repository - https://github.com/DevExpPlatform/required-workflows/policies/default.yaml
2024-11-05T09:05:27.3336475Z Cloning policy repo - DevExpPlatform/required-workflows@main
2024-11-05T09:05:27.3337414Z Loading policy file - /tmp/repo/policies/default.yaml
2024-11-05T09:05:27.3338133Z Policy loaded successfully
2024-11-05T09:05:27.3338511Z Saving Policy...
2024-11-05T09:05:27.3338851Z Policy saved
2024-11-05T09:05:27.3339224Z Finished loading policy
2024-11-05T09:05:27.3339661Z Policy as Code Summary:
2024-11-05T09:05:27.3340010Z 2024-11-05T09:05:27.3340411Z general: 'high' 2024-11-05T09:05:27.3340941Z codescanning: 'high' 2024-11-05T09:05:27.3341342Z dependabot: 'high' 2024-11-05T09:05:27.3341797Z licensing: 'high' 2024-11-05T09:05:27.3342137Z dependencies: 'high' 2024-11-05T09:05:27.3342509Z secretscanning: 'high' 2024-11-05T09:05:27.3342921Z
2024-11-05T09:05:27.3343606Z ##[endgroup]
2024-11-05T09:05:27.3344274Z ##[group]Code Scanning Results
2024-11-05T09:05:27.3367018Z ##[error]Unknown Exception was hit, please repo this to https://github.com/advanced-security/policy-as-code
2024-11-05T09:05:27.3368755Z ##[error]Not Found (status code: 404)
2024-11-05T09:05:28.5948520Z INFO:root:Total Dependabot Alerts :: 0
2024-11-05T09:05:28.5950156Z INFO:root:Dependabot violations :: 0
2024-11-05T09:05:29.6864029Z INFO:root:Total Dependency Graph :: 7
2024-11-05T09:05:29.6865741Z INFO:root:Dependency Graph violations :: 0
2024-11-05T09:05:30.8203191Z INFO:root:Loaded extra licensing information :: 9459
2024-11-05T09:05:30.8204864Z INFO:root:Total Dependencies in Graph :: 7
2024-11-05T09:05:30.8249233Z INFO:root:Dependency Graph violations :: 0
2024-11-05T09:05:31.3511699Z INFO:root:Total Secret Scanning Alerts :: 0
2024-11-05T09:05:31.3513926Z INFO:root:Secret Scanning violations :: 0
2024-11-05T09:05:31.3515634Z ##[group]Dependabot Results
2024-11-05T09:05:31.3516756Z Total Dependabot Alerts :: 0
2024-11-05T09:05:31.3517652Z Dependabot violations :: 0
2024-11-05T09:05:31.3518961Z ##[endgroup]
2024-11-05T09:05:31.3520275Z ##[group]Dependency Graph
2024-11-05T09:05:31.3521075Z Total Dependency Graph :: 7
2024-11-05T09:05:31.3521938Z Dependency Graph violations :: 0
2024-11-05T09:05:31.3523024Z ##[endgroup]
2024-11-05T09:05:31.3524396Z ##[group]Dependency Graph Results - Licensing
2024-11-05T09:05:31.3525252Z Loaded extra licensing information :: 9459
2024-11-05T09:05:31.3526061Z Total Dependencies in Graph :: 7
2024-11-05T09:05:31.3526959Z Dependency Graph violations :: 0
2024-11-05T09:05:31.3527987Z ##[endgroup]
2024-11-05T09:05:31.3529004Z ##[group]Secret Scanning Results
2024-11-05T09:05:31.3529631Z Total Secret Scanning Alerts :: 0
2024-11-05T09:05:31.3530204Z Secret Scanning violations :: 0
2024-11-05T09:05:31.3531234Z ##[endgroup]
2024-11-05T09:05:31.3531916Z ##[endgroup]
2024-11-05T09:05:31.3532732Z ##[group]Summary
2024-11-05T09:05:31.3533197Z Total unacceptable alerts :: 1
2024-11-05T09:05:31.3534904Z ##[error]Unacceptable Threshold of Risk has been hit!
2024-11-05T09:05:31.3536170Z INFO:root:Total unacceptable alerts :: 1
2024-11-05T09:05:31.3539107Z ERROR:root:Unacceptable Threshold of Risk has been hit!
2024-11-05T09:05:31.3743448Z ##[error]Process completed with exit code 1.
2024-11-05T09:05:31.4025831Z Cleaning up orphan processes

Code of Conduct

• I agree to follow this project's Code of Conduct