SARIF results exceed one or more limits

About code scanning limits on SARIF results

# SARIF results exceed soft limits
  Locations for an alert exceeded limits
  Analysis SARIF file exceeded alert limits
  Rule tags in SARIF file exceed limits
  Alert in SARIF upload exceeded thread flow location limits

# SARIF results exceed hard limit
  Alert(s) in SARIF file exceeded thread flow location limits
  Analysis SARIF file rejected due to extension limits
  Analysis SARIF file rejected due to location limit
  Analysis SARIF file rejected due to rule tag limits
  Analysis SARIF file rejected due to result limits
  Analysis SARIF file rejected due to rule limits
  Analysis SARIF file rejected due to run limits

Code scanning sets two types of limits on fields in SARIF results files.

• Soft limits which determine how much data is stored and displayed to users.
• Hard limits which determine the maximum amount of data accepted for processing.

You could see these errors for SARIF files generated by CodeQL or by third-party analysis tools.

For information about validating your SARIF file, see "SARIF support for code scanning."

Fixing soft limit errors

When soft limits are exceeded, code scanning shows the highest priority information. Often you do not need to make any changes to your code scanning configuration. As your team fixes alerts, the number of results reported in each run will reduce until they are within the soft limits and all results are displayed. Alternatively, you can use the approaches described for hard limit errors.

Fixing "Analysis SARIF file rejected due to results limits"

There are many considerations and potential solutions for reducing the number of results included in a SARIF results file. For guidance, see "SARIF results file is too large."

Fixing "Alert(s) in SARIF file exceeded thread flow location limits"

You can configure the analysis to limit the number of dataflow paths included in the results. By default, 4 dataflow paths are included for each result.

• CodeQL advanced setup for code scanning: update the analyze step to limit the number of paths to a maximum of one or zero.

  - name: Perform CodeQL Analysis
    uses: github/codeql-action/analyze@v3
    env: 
      CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"interpret-results":["--max-paths", 1]}}'
  

• CodeQL CLI database analyze: update the database analysis command to include the --max-paths=1 flag. For more information, see "database analyze."

Fixing "Analysis SARIF file rejected due to run limits"

The simplest approach is generate a new SARIF file for each run and upload each file separately. You add a "category" to each results and this enables code scanning to store and display the results appropriately. For more information, see "SARIF support for code scanning."

Fixing "Analysis SARIF file rejected due to rule limits"

There are two possible approaches here.

1. Reduce the number of rules you use to analyze the code. For more information, see "Defining the query suite to run" and "Excluding a query from analysis" in "SARIF results file too large."
2. Run the analysis twice, each time with a different set of rules, and upload both results files to code scanning. For more information, see "SARIF support for code scanning."

Fixing "Analysis SARIF file rejected due to extension limits"

The simplest approach is to create a separate SARIF file each time you run the tool and upload each file separately. You may also need to contact the maintainer of the tool. For more information, see "SARIF support for code scanning."

CodeQL analysis should not generate this error. If you see this error while using the CodeQL action or CodeQL CLI, you should contact GitHub Support to let us know. For more information, see "Contacting GitHub Support."

Fixing "Analysis SARIF file rejected due to location limit"

The best way to resolve this problem is usually to identify the query that reports too many locations and exclude it from analysis. For information on how to do this, see "SARIF results file is too large."

Fixing "Analysis SARIF file rejected due to rule tag limits"

You need to update the SARIF file or the generator so that the array of tags reported for each reportingDescriptor object is fewer than 10. For more information, see properties.tags[] in "SARIF support for code scanning."