From e31ffd9b6603939e45b80af4a935c1e8485e51e3 Mon Sep 17 00:00:00 2001
From: Matt Andreko <mandreko@bitwarden.com>
Date: Thu, 20 Mar 2025 12:29:24 -0400
Subject: [PATCH] Update SARIF upload to use proper branch (#13917)

---
 .github/workflows/build-web.yml | 2 ++
 .github/workflows/scan.yml      | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/build-web.yml b/.github/workflows/build-web.yml
index bd96b388c6a..3cc0df5103c 100644
--- a/.github/workflows/build-web.yml
+++ b/.github/workflows/build-web.yml
@@ -323,6 +323,8 @@ jobs:
         uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
         with:
           sarif_file: ${{ steps.container-scan.outputs.sarif }}
+          sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
 
       - name: Log out of Docker
         run: docker logout
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index c5e189c4666..77b66ba8bf1 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -49,6 +49,8 @@ jobs:
         uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
         with:
           sarif_file: cx_result.sarif
+          sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
 
   quality:
     name: Quality scan