The Security/CWE-117/LogInjection.ql query has been consistently failing
with 'Result set is larger than the limit of 2GiB' on every scheduled and
push run for the last several days, breaking CodeQL / Analyze (python) on
main and litellm_internal_staging.
This is the same known CodeQL scaling limitation already documented for
py/clear-text-logging-sensitive-data (CWE-312) and py/polynomial-redos
(CWE-730): taint-flow queries produce combinatorial path explosion on
codebases with pervasive logging like LiteLLM. Extend the existing
exclusion pattern to cover py/log-injection.
Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>
Switch query suite from security-extended to security-and-quality to
match the default GitHub Advanced Security setup. Run scheduled scans
daily instead of weekly. Remove paths-ignore for _experimental/out so
build artifacts are also scanned.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(codeql): switch to security-extended query suite
The security-and-quality suite produces result sets > 2 GiB on this
codebase, causing fatal OOM failures and blocking CI. Switching to
security-extended reduces query scope to security-only checks, which
still complete successfully. Quality/maintainability checks are
already covered by the existing lint pipeline.
* fix(codeql): exclude OOM queries from security-extended
The default CodeQL setup runs all 45 Python security queries against the
entire codebase. Two queries (CleartextLogging, PolynomialReDoS) produce
result sets > 2 GiB, causing 49+ minute runs that fail and block CI.
- Add custom workflow with 30-minute timeout and concurrency limits
- Exclude py/clear-text-logging-sensitive-data (CWE-312)
- Exclude py/polynomial-redos (CWE-730)
- Skip scanning tests/, docs/, and UI build output
NOTE: The Default Setup must be disabled in repo Settings > Code security
before merging, otherwise both will run simultaneously.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
