ci: CodeQL check stays queued with two analysis categories missing
Observed failure
The required GitHub Advanced Security CodeQL check for #10693 remains queued after the CodeQL workflow and SARIF processing both report success. The completed upload exposes only the JavaScript/TypeScript analysis; the C# and Actions categories are missing.
- PR head:
610c3eaec9bdfbec5d079e7cbfe7b7f781a22ecc - Current PR merge commit:
5594368a27f77724bd74827d70535a1fbb5fa376 - Queued check: https://github.com/dotnet/orleans/runs/105170578850
- CodeQL workflow: https://github.com/dotnet/orleans/actions/runs/35210129256
- Upload job: https://github.com/dotnet/orleans/actions/runs/35210129256/job/105170479010
- SARIF upload ID:
3b462322-b284-11f1-839f-9b68c6673cbe
The check has status=queued, started_at=2026-09-17T10:40:44Z, no conclusion, and an empty output. It was still queued during repeated maintenance observations after 11:13 UTC. The CodeQL workflow completed successfully at 10:40:53 UTC. The separate .NET CI, documentation, and static-analysis workflows also succeeded.
Evidence
All three analysis jobs succeeded. The upload job downloaded all three artifacts and logged all three input files before invoking CodeQL 2.27.0:
codeql github merge-results --output <combined-sarif.sarif>
--sarif <codeql-sarif-actions/upload.sarif>
--sarif <codeql-sarif-csharp/upload.sarif>
--sarif <codeql-sarif-javascript-typescript/upload.sarif>
--sarif-merge-runs-from-equal-categoryThe downloaded input artifacts each contain one SARIF run with a distinct automation ID and CodeQL semantic version 2.27.0:
| Artifact | Artifact ID | Input automationDetails.id | Results |
|---|---|---|---|
codeql-sarif-actions |
10490534368 | /language:actions/ |
0 |
codeql-sarif-csharp |
10492102472 | /language:csharp/ |
0 |
codeql-sarif-javascript-typescript |
10491613525 | /language:javascript-typescript/ |
0 |
The upload log reports successful upload at 10:40:45 UTC and processing complete at 10:40:50 UTC. The SARIF status API independently reports processing_status=complete with no errors.
However, querying all analyses for that SARIF upload returns only analysis 1792247626, category /language:javascript-typescript, for the correct current merge commit. It has empty error/warning fields and zero results. C# and Actions are absent. The latest C#/Actions analyses for the PR merge ref belong to the previous merge commit 2655d5f7ea326a4c3569b214b90b4f64494ec273.
These observations were revalidated before filing. The completed upload's combined SARIF payload was not retained among the run artifacts, so the available evidence does not yet distinguish a client-side merge problem from downstream processing/reporting.
Scope and existing fixes
.github/workflows/codeql.yml is unchanged between the failing PR head and main 2e40fa8a3ba30a443a9e0332acea4f94733f5afb. The workflow already includes #10295, which consolidated language uploads to avoid incomplete configuration evaluation, and #10984, which expands scheduled queries. Both fixes are ancestors of this head; rebasing would not add them.
Repository issue/PR searches found no matching open tracker or newer unincluded fix. No workflow rerun, source change, or check override was used during this investigation.
Expected outcome and follow-up
The aggregate upload should register all three language categories and complete the required check. Preserve the original run evidence while investigating the merged SARIF payload and GitHub processing/reporting. A successful retry alone would not explain the missing analyses.
Source: dotnet/orleans