Code Scanning "rejecting SARIF, as it is too large" in CI

By Daniel Zoghalchali·Latchkey

GitHub enforces limits on SARIF uploads: the file size and the number of results and rules per upload are capped. A very large scan output exceeds these and the entire file is rejected.

What this error means

upload-sarif fails with "rejecting SARIF, as it is too large" or a message that the number of results or the file size exceeds the allowed limit.

Error: rejecting SARIF, as it is too large.
The number of results in the SARIF file (28431) exceeds the maximum allowed (25000).

Common causes

Too many results in one upload

A broad ruleset over a large codebase produces more findings than the per-upload results limit allows.

The SARIF file itself is oversized

Verbose messages, embedded code, or duplicated locations inflate the file beyond the size cap.

How to fix it

Reduce results or split by category

1. Narrow the ruleset or exclude noisy paths so fewer results are emitted.
2. Split the scan into multiple uploads with distinct categories.
3. Re-run so each upload stays under the limit.

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results-frontend.sarif
    category: frontend

Trim verbose SARIF output

Disable embedded snippets or reduce message verbosity in the tool config so the file size drops under the cap.

How to prevent it

• Scope rulesets to what you triage to keep result counts down.
• Split large scans into per-category uploads.
• Exclude generated and vendored paths from analysis.

Frequently asked questions

Related guides

References

• GitHub Actions documentation