Function handleScanResponse

code-scan-action/src/main.ts:634–691

(
  scanResponse: ScanResponse,
  inputs: ActionInputs,
  context: PullRequestContext,
)

}

async function handleScanResponse(
  scanResponse: ScanResponse,
  inputs: ActionInputs,
  context: PullRequestContext,
): Promise<void> {
  const { comments, commentsPosted, review, skipReason } = scanResponse;
  const hasSarifFindings = hasSarifReportableFindings(scanResponse);
  const hasPrFindings = hasPrPostableFindings(comments);

  // A skipped scan is not a clean scan. Do not upload empty SARIF results that could clear
  // existing Code Scanning findings or imply that authorization-gated work ran. Mixed
  // responses still need processing when a finding can be surfaced through SARIF or PR
  // comments, because those output channels intentionally support different locations.
  if (skipReason && !hasSarifFindings && !hasPrFindings) {
    core.info(`🔀 Scan skipped: ${skipReason}`);
    return;
  }

  if (skipReason) {
    // Carry the skipReason into the warning: a contradictory response (skip + real
    // findings) signals a server-side bug, and the reason text is the operator's only
    // clue to which path produced it.
    core.warning(
      `Scan response included findings alongside a skipReason ("${skipReason}"); processing findings.`,
    );
  }

  core.info(`📊 Found ${comments.length} comments${review ? ' and review summary' : ''}`);

  // A mixed skip with only PR-postable findings must not upload an empty SARIF run.
  if (!skipReason || hasSarifFindings) {
    emitConfiguredSarifOutput(scanResponse, inputs);
  }

  if ((hasPrFindings || review) && commentsPosted === false) {
    await postFallbackComments(
      inputs.githubToken,
      context,
      comments,
      review,
      inputs.minimumSeverity,
    );
    return;
  }

  if (comments.length > 0 && commentsPosted === true) {
    core.info('✅ Comments posted to PR by scan server');
    return;
  }

  if (comments.length > 0) {
    // commentsPosted is undefined - old server version
    core.info('✅ Comments returned (server version does not indicate if posted)');
    return;
  }

  core.info('✨ No vulnerabilities found!');
}