Check if on default branch before uploading database

src/actions-util.ts

@@ -691,3 +691,19 @@ export function getRelativeScriptPath(): string {
   const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
   return path.relative(actionsDirectory, __filename);
 }
+
+// Is the version of the repository we are currently analyzing from the default branch,
+// or alternatively from another branch or a pull request.
+export async function isAnalyzingDefaultBranch(): Promise<boolean> {
+  // Get the current ref and trim and refs/heads/ prefix
+  let currentRef = await getRef();
+  currentRef = currentRef.startsWith("refs/heads/")
+    ? currentRef.substr("refs/heads/".length)
+    : currentRef;
+
+  const eventJson = JSON.parse(
+    fs.readFileSync(getRequiredEnvParam("GITHUB_EVENT_PATH"), "utf-8")
+  );
+
+  return currentRef === eventJson?.repository?.default_branch;
+}

src/analyze-action.ts

@@ -58,8 +58,13 @@ async function uploadDatabases(
   apiDetails: GitHubApiDetails,
   logger: Logger
 ): Promise<void> {
-  const client = getApiClient(apiDetails);
+  if (!(await actionsUtil.isAnalyzingDefaultBranch())) {
+    // We only want to upload a database if we are analyzing the default branch.
+    logger.debug("Not analyzing default branch. Skipping upload.");
+    return;
+  }
 
+  const client = getApiClient(apiDetails);
   const optInResponse = await client.request(
     "GET /repos/:owner/:repo/code-scanning/databases",
     {
@@ -92,7 +97,9 @@ async function uploadDatabases(
         data: payload,
       }
     );
-    if (uploadResponse.status !== 201) {
+    if (uploadResponse.status === 201) {
+      logger.debug(`Successfully uploaded database for ${language}`);
+    } else {
       // Log a warning but don't fail the workflow
       logger.warning(
         `Failed to upload database for ${language}. ${uploadResponse.data}`