Analysis upload fails with `rejecting SARIF, as there are more threadflow steps per result than allowed (19350 > 10000)`

Bắt đầu với bước tải lên của CodeQL Action và các stack frame được tham chiếu trong upload-lib.js và analyze-action.js; tái hiện lỗi bằng workflow systemd được hiển thị và job mẫu. Xác định xem có thể giảm thiểu giới hạn threadflow của SARIF hay không, sau đó ghi lại một cấu hình hoạt động được hoặc xác nhận rằng việc tải lên vẫn bị từ chối.

Hello!

Today I wanted to enhance our CodeQL scan in the systemd repo by using the security-extended and security-and-quality query sets, but after adding them the CodeQL action can no longer upload the resulting SARIF file:

Waiting for processing to finish
  Analysis upload status is pending.
  Analysis upload status is failed.
  Error: Code Scanning could not process the submitted SARIF file:
  rejecting SARIF, as there are more threadflow steps per result than allowed (19350 > 10000)
  Error: Code Scanning could not process the submitted SARIF file:
  rejecting SARIF, as there are more threadflow steps per result than allowed (19350 > 10000)
      at Object.waitForProcessing (/home/runner/work/_actions/github/codeql-action/0c670bbf0414f39666df6ce8e718ec5662c21e03/lib/upload-lib.js:334:19)
      at async run (/home/runner/work/_actions/github/codeql-action/0c670bbf0414f39666df6ce8e718ec5662c21e03/lib/analyze-action.js:131:13)
      at async runWrapper (/home/runner/work/_actions/github/codeql-action/0c670bbf0414f39666df6ce8e718ec5662c21e03/lib/analyze-action.js:221:9)

Example job: https://github.com/systemd/systemd/actions/runs/3053021449/jobs/4923112318

Configuration:

---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
#
name: "CodeQL"

on:
  pull_request:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - '**/meson.build'
      - '.github/**/codeql*'
      - 'src/**'
      - 'test/**'
      - 'tools/**'
  push:
    branches:
      - main
      - v[0-9]+-stable

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-22.04
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      actions: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['cpp', 'python']

    steps:
    - name: Checkout repository
      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b

    - name: Initialize CodeQL
      uses: github/codeql-action/init@0c670bbf0414f39666df6ce8e718ec5662c21e03
      with:
        languages: ${{ matrix.language }}
        queries: +security-extended,security-and-quality

    - run: sudo -E .github/workflows/unit_tests.sh SETUP

    - name: Autobuild
      uses: github/codeql-action/autobuild@0c670bbf0414f39666df6ce8e718ec5662c21e03

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@0c670bbf0414f39666df6ce8e718ec5662c21e03

Since the build & analysis finishes successfully and only the last step fails, I don't think this is an issue on our side - is there something which can be done to mitigate this or we're out of luck?

Thank you!