upload-sarif always warns when setting partialFingerprints

[tylerbrazier]

The documentation recommends calculating partialFingerprints before uploading:

To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the partialFingerprints property before you upload the SARIF file.

However, this always results in a warning in the output with no way to suppress it. If calculating the fingerprint is the recommendation then we should not be seeing a warning for it.

[mbg]

Hi @tylerbrazier,

The part of the documentation you quoted is about the general requirement for fingerprints in SARIF files when uploading them to Code Scanning to ensure stable alerts.

If you are using the CodeQL Action, then the CodeQL Action already generates the fingerprints for you before uploading a SARIF file to Code Scanning. You shouldn't need to calculate them yourself in that case. Indeed, the sentence after the one you quoted suggests looking at the CodeQL Action implementation as a reference. You would only need to generate them yourself if you are uploading files directly to the API.

Can you clarify whether you are using the analyze or upload-sarif action and whether you have encountered any issues with the fingerprints that are automatically generated by the CodeQL Action?