SARIF results exceed one or more limits

About code scanning limits on SARIF results

# SARIF results exceed soft limits
  Locations for an alert exceeded limits
  Analysis SARIF file exceeded alert limits
  Rule tags in SARIF file exceed limits
  Alert in SARIF upload exceeded thread flow location limits
  Repository is at risk of exceeding the alert limit.

# SARIF results exceed hard limit
  Alert(s) in SARIF file exceeded thread flow location limits
  Analysis SARIF file rejected due to extension limits
  Analysis SARIF file rejected due to location limit
  Analysis SARIF file rejected due to rule tag limits
  Analysis SARIF file rejected due to result limits
  Analysis SARIF file rejected due to rule limits
  Analysis SARIF file rejected due to run limits
  All analysis uploads blocked due to alert limit

Code scanning sets two types of limits on fields in SARIF results files.

• Soft limits which determine how much data is stored and displayed to users.
• Hard limits which determine the maximum amount of data accepted for processing.

You could see these errors for SARIF files generated by CodeQL or by third-party analysis tools.

For information about validating your SARIF file, see SARIF support for code scanning.

Fixing soft limit errors

When soft limits are exceeded, code scanning shows the highest priority information. Often you do not need to make any changes to your code scanning configuration. As your team fixes alerts, the number of results reported in each run will reduce until they are within the soft limits and all results are displayed. Alternatively, you can use the approaches described for hard limit errors.

Fixing "Analysis SARIF file rejected due to results limits"

There are many considerations and potential solutions for reducing the number of results included in a SARIF results file. For guidance, see SARIF results file is too large.

Fixing "Alert(s) in SARIF file exceeded thread flow location limits"

You can configure the analysis to limit the number of dataflow paths included in the results. By default, 4 dataflow paths are included for each result.

• CodeQL advanced setup for code scanning: update the analyze step to limit the number of paths to a maximum of one or zero.

  - name: Perform CodeQL Analysis
    uses: github/codeql-action/analyze@v3
    env: 
      CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"interpret-results":["--max-paths", 1]}}'
  

• CodeQL CLI database analyze: update the database analysis command to include the --max-paths=1 flag. For more information, see database analyze.

Fixing "Analysis SARIF file rejected due to run limits"

The simplest approach is generate a new SARIF file for each run and upload each file separately. You add a "category" to each results and this enables code scanning to store and display the results appropriately. For more information, see SARIF support for code scanning.

Fixing "Analysis SARIF file rejected due to rule limits"

There are two possible approaches here.

1. Reduce the number of rules you use to analyze the code. For more information, see Excluding a query from analysis in "SARIF results file too large."
2. Run the analysis twice, each time with a different set of rules, and upload both results files to code scanning. For more information, see SARIF support for code scanning.

Fixing "Analysis SARIF file rejected due to extension limits"

The simplest approach is to create a separate SARIF file each time you run the tool and upload each file separately. You may also need to contact the maintainer of the tool. For more information, see SARIF support for code scanning.

CodeQL analysis should not generate this error. If you see this error while using the CodeQL action or CodeQL CLI, you should contact GitHub Support to let us know. For more information, see Contacting GitHub Support.

Fixing "Analysis SARIF file rejected due to location limit"

The best way to resolve this problem is usually to identify the query that reports too many locations and exclude it from analysis. For information on how to do this, see SARIF results file is too large.

Fixing "Analysis SARIF file rejected due to rule tag limits"

You need to update the SARIF file or the generator so that the array of tags reported for each reportingDescriptor object is fewer than 10. For more information, see properties.tags[] in SARIF support for code scanning.

Fixing "Repository is at risk of exceeding the alert limit" & "All analysis uploads blocked due to alert limit"

This limit is triggered by a repository producing more unique alerts than should ever exist as part of a well functioning code scanning configuration. It is possible that this is due to the output of a third-party tool being used, and may not be a user configuration error. Both user configuration error and tool vendor error are possible causes.

There are a few steps to fix this problem.

1. Look at the SARIF files you are producing to identify the cause of code scanning alerts being classed as distinct across runs of a tool. Usually this is due to one of the following:
   • The SARIF artifactLocation.uri property (filepath in the code scanning alert user interface) is not deterministic due to the inclusion of temporary directories or generated file names.
   • The tool used produces unstable SARIF rule names or artifactLocation object uri property values, which is usually the result of using hashes (from git commits or docker image SHAs, for example) or other sources of data that change across runs or environments.
2. Once you have identified the source of the issue, you should update your configuration accordingly, and contact the tool vendor if their tool is the source of the unstable SARIF results.
3. Stop uploading code scanning results for any third-party tools that produce non-deterministic output until they have been fixed by the tool vendor.

Additional steps for "All analysis uploads blocked due to alert limit"

On top of fixing the code scanning configuration and removing or fixing the output of third-party tools, you will need to contact us through the GitHub Support portal to assist you in deleting the alerts for any offending configurations.

There is no self-service method for deleting alerts at this time, so contacting customer support is necessary before code-scanning can be re-enabled.