github/codeql-action/init@v2 fails with "Augmented user configuration file contents {}"

[jfoclpf]

Everything was working fine, but suddenly the step of github/codeql-action/init@v2 started to fail in the codeql action of my repo.

Just FYI, my repo is very large, already some Gb

full log here:

2023-03-21T08:35:52.5766644Z Requested labels: ubuntu-latest
2023-03-21T08:35:52.5766739Z Job defined at: jfoclpf/geoapi.pt/.github/workflows/codeql.yml@refs/heads/main
2023-03-21T08:35:52.5766925Z Waiting for a runner to pick up this job...
2023-03-21T08:35:54.9252964Z Job is waiting for a hosted runner to come online.
2023-03-21T08:35:56.7021160Z Job is about to start running on the hosted runner: GitHub Actions 6 (hosted)
2023-03-21T08:35:59.7134531Z Current runner version: '2.303.0'
2023-03-21T08:35:59.7164643Z ##[group]Operating System
2023-03-21T08:35:59.7165210Z Ubuntu
2023-03-21T08:35:59.7165497Z 22.04.2
2023-03-21T08:35:59.7165721Z LTS
2023-03-21T08:35:59.7166086Z ##[endgroup]
2023-03-21T08:35:59.7166414Z ##[group]Runner Image
2023-03-21T08:35:59.7166761Z Image: ubuntu-22.04
2023-03-21T08:35:59.7167029Z Version: 20230313.1
2023-03-21T08:35:59.7167522Z Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20230313.1/images/linux/Ubuntu2204-Readme.md
2023-03-21T08:35:59.7168181Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20230313.1
2023-03-21T08:35:59.7168574Z ##[endgroup]
2023-03-21T08:35:59.7168907Z ##[group]Runner Image Provisioner
2023-03-21T08:35:59.7169236Z 2.0.127.1
2023-03-21T08:35:59.7169471Z ##[endgroup]
2023-03-21T08:35:59.7170212Z ##[group]GITHUB_TOKEN Permissions
2023-03-21T08:35:59.7170721Z Actions: read
2023-03-21T08:35:59.7171024Z Contents: read
2023-03-21T08:35:59.7171562Z Metadata: read
2023-03-21T08:35:59.7171937Z SecurityEvents: write
2023-03-21T08:35:59.7172279Z ##[endgroup]
2023-03-21T08:35:59.7175992Z Secret source: Actions
2023-03-21T08:35:59.7176480Z Prepare workflow directory
2023-03-21T08:35:59.8020571Z Prepare all required actions
2023-03-21T08:35:59.8208582Z Getting action download info
2023-03-21T08:36:00.0618749Z Download action repository 'actions/checkout@v3' (SHA:24cb9080177205b6e8c946b17badbe402adc938f)
2023-03-21T08:36:00.6292878Z Download action repository 'github/codeql-action@v2' (SHA:168b99b3c22180941ae7dbdd5f5c9678ede476ba)
2023-03-21T08:36:05.5980943Z Complete job name: Analyze (javascript)
2023-03-21T08:36:05.6924804Z ##[group]Run actions/checkout@v3
2023-03-21T08:36:05.6925135Z with:
2023-03-21T08:36:05.6925377Z   repository: jfoclpf/geoapi.pt
2023-03-21T08:36:05.6925851Z   token: ***
2023-03-21T08:36:05.6926062Z   ssh-strict: true
2023-03-21T08:36:05.6926296Z   persist-credentials: true
2023-03-21T08:36:05.6926513Z   clean: true
2023-03-21T08:36:05.6926735Z   fetch-depth: 1
2023-03-21T08:36:05.6926949Z   lfs: false
2023-03-21T08:36:05.6927142Z   submodules: false
2023-03-21T08:36:05.6927375Z   set-safe-directory: true
2023-03-21T08:36:05.6927611Z ##[endgroup]
2023-03-21T08:36:05.9525043Z Syncing repository: jfoclpf/geoapi.pt
2023-03-21T08:36:05.9527300Z ##[group]Getting Git version info
2023-03-21T08:36:05.9527979Z Working directory is '/home/runner/work/geoapi.pt/geoapi.pt'
2023-03-21T08:36:05.9528522Z [command]/usr/bin/git version
2023-03-21T08:36:05.9588280Z git version 2.39.2
2023-03-21T08:36:05.9618954Z ##[endgroup]
2023-03-21T08:36:05.9643474Z Temporarily overriding HOME='/home/runner/work/_temp/ea68364f-aa97-4bec-b706-a548f2712a3b' before making global git config changes
2023-03-21T08:36:05.9644012Z Adding repository directory to the temporary git global config as a safe directory
2023-03-21T08:36:05.9646296Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/geoapi.pt/geoapi.pt
2023-03-21T08:36:05.9706670Z Deleting the contents of '/home/runner/work/geoapi.pt/geoapi.pt'
2023-03-21T08:36:05.9716216Z ##[group]Initializing the repository
2023-03-21T08:36:05.9724602Z [command]/usr/bin/git init /home/runner/work/geoapi.pt/geoapi.pt
2023-03-21T08:36:05.9792601Z hint: Using 'master' as the name for the initial branch. This default branch name
2023-03-21T08:36:05.9793373Z hint: is subject to change. To configure the initial branch name to use in all
2023-03-21T08:36:05.9794082Z hint: of your new repositories, which will suppress this warning, call:
2023-03-21T08:36:05.9794835Z hint: 
2023-03-21T08:36:05.9795472Z hint: 	git config --global init.defaultBranch 
2023-03-21T08:36:05.9795819Z hint: 
2023-03-21T08:36:05.9796163Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
2023-03-21T08:36:05.9796620Z hint: 'development'. The just-created branch can be renamed via this command:
2023-03-21T08:36:05.9796904Z hint: 
2023-03-21T08:36:05.9797136Z hint: 	git branch -m 
2023-03-21T08:36:05.9843017Z Initialized empty Git repository in /home/runner/work/geoapi.pt/geoapi.pt/.git/
2023-03-21T08:36:05.9860227Z [command]/usr/bin/git remote add origin https://github.com/jfoclpf/geoapi.pt
2023-03-21T08:36:05.9910752Z ##[endgroup]
2023-03-21T08:36:05.9911744Z ##[group]Disabling automatic garbage collection
2023-03-21T08:36:05.9918767Z [command]/usr/bin/git config --local gc.auto 0
2023-03-21T08:36:05.9956441Z ##[endgroup]
2023-03-21T08:36:05.9957418Z ##[group]Setting up auth
2023-03-21T08:36:05.9967389Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2023-03-21T08:36:06.0006280Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2023-03-21T08:36:06.0345409Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
2023-03-21T08:36:06.0374202Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2023-03-21T08:36:06.0638287Z [command]/usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
2023-03-21T08:36:06.0675657Z ##[endgroup]
2023-03-21T08:36:06.0681264Z ##[group]Fetching the repository
2023-03-21T08:36:06.0719239Z [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +f2a3bf67ec0859720c08ff18399b77c6e0941063:refs/remotes/origin/main
2023-03-21T08:36:07.6803164Z remote: Enumerating objects: 308254        
2023-03-21T08:36:07.6803571Z remote: Enumerating objects: 414537, done.        
2023-03-21T08:36:07.7300151Z remote: Counting objects:   0% (1/414537)        
 
2023-03-21T08:36:08.0129300Z remote: Counting objects: 100% (414537/414537), done.        
2023-03-21T08:36:09.0400434Z remote: Compressing objects:   0% (1/238887)        
2023-03-21T08:36:[10.2271927Z](http://dx.doi.org/10.2271927Z) remote: Compressing objects:   0% (57/238887)        

2023-03-21T08:36:55.5665551Z remote: Compressing objects: 100% (238887/238887), done.        
2023-03-21T08:36:55.9438468Z Receiving objects:   0% (1/414537)

2023-03-21T08:38:32.3682672Z remote: Total 414537 (delta 174211), reused 413149 (delta 173706), pack-reused 0        
2023-03-21T08:38:32.3700808Z Receiving objects: 100% (414537/414537), 2.74 GiB | 22.39 MiB/s
2023-03-21T08:38:32.3701388Z Receiving objects: 100% (414537/414537), 2.74 GiB | 29.09 MiB/s, done.
2023-03-21T08:38:32.4725015Z Resolving deltas:   0% (0/174211)

2023-03-21T08:38:42.1241862Z Resolving deltas: 100% (174211/174211), done.
2023-03-21T08:38:44.9084787Z From https://github.com/jfoclpf/geoapi.pt
2023-03-21T08:38:44.9085803Z  * [new ref]               f2a3bf67ec0859720c08ff18399b77c6e0941063 -> origin/main
2023-03-21T08:38:44.9110638Z ##[endgroup]
2023-03-21T08:38:44.9111121Z ##[group]Determining the checkout info
2023-03-21T08:38:44.9112701Z ##[endgroup]
2023-03-21T08:38:44.9113149Z ##[group]Checking out the ref
2023-03-21T08:38:44.9118701Z [command]/usr/bin/git checkout --progress --force -B main refs/remotes/origin/main
2023-03-21T08:38:46.3933765Z Updating files:   3% (12083/399881)

2023-03-21T08:40:10.0905678Z Updating files: 100% (399881/399881), done.
2023-03-21T08:40:10.7058890Z Switched to a new branch 'main'
2023-03-21T08:40:10.7061310Z branch 'main' set up to track 'origin/main'.
2023-03-21T08:40:10.7685933Z ##[endgroup]
2023-03-21T08:40:[10.7760261Z](http://dx.doi.org/10.7760261Z) [command]/usr/bin/git log -1 --format='%H'
2023-03-21T08:40:[10.7785529Z](http://dx.doi.org/10.7785529Z) 'f2a3bf67ec0859720c08ff18399b77c6e0941063'
2023-03-21T08:40:10.8250869Z ##[group]Run github/codeql-action/init@v2
2023-03-21T08:40:10.8251158Z with:
2023-03-21T08:40:10.8251336Z   debug: true
2023-03-21T08:40:10.8251556Z   languages: javascript
2023-03-21T08:40:10.8252047Z   token: ***
2023-03-21T08:40:[10.8252288Z](http://dx.doi.org/10.8252288Z)   matrix: {
  "language": "javascript"
}
2023-03-21T08:40:10.8252560Z   setup-python-dependencies: true
2023-03-21T08:40:10.8252814Z ##[endgroup]
2023-03-21T08:40:12.8305131Z ##[group]Setup CodeQL tools
2023-03-21T08:40:12.8440830Z Found CodeQL tools version 2.12.4 in the toolcache.
2023-03-21T08:40:12.8442141Z [command]/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/codeql version --format=terse
2023-03-21T08:40:14.7936061Z 2.12.4
2023-03-21T08:40:14.8104382Z [command]/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/codeql version --format=json
2023-03-21T08:40:15.4726269Z {
2023-03-21T08:40:15.4726806Z   "productName" : "CodeQL",
2023-03-21T08:40:15.4727148Z   "vendor" : "GitHub",
2023-03-21T08:40:15.4727748Z   "version" : "2.12.4",
2023-03-21T08:40:15.4728101Z   "sha" : "ed22a97a18ef41ae33c5ae2b91b4a77583355357",
2023-03-21T08:40:15.4728443Z   "branches" : [
2023-03-21T08:40:15.4729054Z     "codeql-cli-2.12.4"
2023-03-21T08:40:15.4729331Z   ],
2023-03-21T08:40:15.4729747Z   "copyright" : "Copyright (C) 2019-2023 GitHub, Inc.",
2023-03-21T08:40:15.4730281Z   "unpackedLocation" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql",
2023-03-21T08:40:15.4730752Z   "configFileLocation" : "/home/runner/.config/codeql/config",
2023-03-21T08:40:15.4731100Z   "configFileFound" : false
2023-03-21T08:40:15.4736885Z }
2023-03-21T08:40:15.4847838Z ##[endgroup]
2023-03-21T08:40:15.4864608Z ##[group]Load language configuration
2023-03-21T08:40:15.4865877Z Languages from configuration: javascript
2023-03-21T08:40:15.4870519Z [command]/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/codeql resolve queries javascript-code-scanning.qls --format=bylanguage
2023-03-21T08:40:16.7904606Z Recording pack reference codeql/javascript-queries at /opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4.
2023-03-21T08:40:16.8841402Z Recording pack reference codeql/suite-helpers at /opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/.codeql/libraries/codeql/suite-helpers/0.4.4.
2023-03-21T08:40:19.2591758Z {
2023-03-21T08:40:19.2592475Z   "byLanguage" : {
2023-03-21T08:40:19.2593652Z     "javascript" : {
2023-03-21T08:40:19.2594659Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/RegExp/IdentityReplacement.ql" : { },
2023-03-21T08:40:19.2595506Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/DOM/TargetBlank.ql" : { },
2023-03-21T08:40:19.2596457Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Electron/DisablingWebSecurity.ql" : { },
2023-03-21T08:40:19.2597728Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Electron/AllowRunningInsecureContent.ql" : { },
2023-03-21T08:40:19.2598774Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-327/BadRandomness.ql" : { },
2023-03-21T08:40:19.2600044Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-327/BrokenCryptoAlgorithm.ql" : { },
2023-03-21T08:40:19.2601189Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-834/LoopBoundInjection.ql" : { },
2023-03-21T08:40:19.2601838Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-776/XmlBomb.ql" : { },
2023-03-21T08:40:19.2602479Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-094/CodeInjection.ql" : { },
2023-03-21T08:40:19.2603419Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-094/UnsafeDynamicMethodAccess.ql" : { },
2023-03-21T08:40:19.2604090Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-094/ExpressionInjection.ql" : { },
2023-03-21T08:40:19.2604757Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-094/ImproperCodeSanitization.ql" : { },
2023-03-21T08:40:19.2605459Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-601/ServerSideUrlRedirect.ql" : { },
2023-03-21T08:40:19.2606110Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-601/ClientSideUrlRedirect.ql" : { },
2023-03-21T08:40:19.2606767Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-201/PostMessageStar.ql" : { },
2023-03-21T08:40:19.2607386Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-338/InsecureRandomness.ql" : { },
2023-03-21T08:40:19.2608039Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-770/ResourceExhaustion.ql" : { },
2023-03-21T08:40:19.2608686Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-770/MissingRateLimiting.ql" : { },
2023-03-21T08:40:19.2609402Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-843/TypeConfusionThroughParameterTampering.ql" : { },
2023-03-21T08:40:19.2610067Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-022/ZipSlip.ql" : { },
2023-03-21T08:40:19.2610692Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-022/TaintedPath.ql" : { },
2023-03-21T08:40:19.2611367Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-915/PrototypePollutingAssignment.ql" : { },
2023-03-21T08:40:19.2612058Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-915/PrototypePollutingFunction.ql" : { },
2023-03-21T08:40:19.2612783Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-915/PrototypePollutingMergeCall.ql" : { },
2023-03-21T08:40:19.2613468Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-830/FunctionalityFromUntrustedSource.ql" : { },
2023-03-21T08:40:19.2614152Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-073/TemplateObjectInjection.ql" : { },
2023-03-21T08:40:19.2614860Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/IncompleteUrlSubstringSanitization.ql" : { },
2023-03-21T08:40:19.2615553Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/IncorrectSuffixCheck.ql" : { },
2023-03-21T08:40:19.2616206Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/UselessRegExpCharacterEscape.ql" : { },
2023-03-21T08:40:19.2617008Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/IncompleteUrlSchemeCheck.ql" : { },
2023-03-21T08:40:19.2617724Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/OverlyLargeRange.ql" : { },
2023-03-21T08:40:19.2618473Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-020/IncompleteHostnameRegExp.ql" : { },
2023-03-21T08:40:19.2619129Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-502/UnsafeDeserialization.ql" : { },
2023-03-21T08:40:19.2619807Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-400/DeepObjectResourceExhaustion.ql" : { },
2023-03-21T08:40:19.2620503Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-754/UnvalidatedDynamicMethodCall.ql" : { },
2023-03-21T08:40:19.2621213Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-295/DisablingCertificateValidation.ql" : { },
2023-03-21T08:40:19.2621954Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql" : { },
2023-03-21T08:40:19.2622640Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-078/CommandInjection.ql" : { },
2023-03-21T08:40:19.2623349Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-078/SecondOrderCommandInjection.ql" : { },
2023-03-21T08:40:19.2624019Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-078/UselessUseOfCat.ql" : { },
2023-03-21T08:40:19.2624713Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-078/UnsafeShellCommandConstruction.ql" : { },
2023-03-21T08:40:19.2625368Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-1004/ClientExposedCookie.ql" : { },
2023-03-21T08:40:19.2626061Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-178/CaseSensitiveMiddlewarePath.ql" : { },
2023-03-21T08:40:19.2626741Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-200/PrivateFileExposure.ql" : { },
2023-03-21T08:40:19.2627404Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-598/SensitiveGetQuery.ql" : { },
2023-03-21T08:40:19.2628079Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-916/InsufficientPasswordHash.ql" : { },
2023-03-21T08:40:19.2628752Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-643/XpathInjection.ql" : { },
2023-03-21T08:40:19.2629411Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-352/MissingCsrfMiddleware.ql" : { },
2023-03-21T08:40:19.2630091Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-798/HardcodedCredentials.ql" : { },
2023-03-21T08:40:19.2630806Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/IncompleteHtmlAttributeSanitization.ql" : { },
2023-03-21T08:40:19.2631487Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/UnsafeHtmlExpansion.ql" : { },
2023-03-21T08:40:19.2632341Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/IncompleteMultiCharacterSanitization.ql" : { },
2023-03-21T08:40:19.2663449Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/DoubleEscaping.ql" : { },
2023-03-21T08:40:19.2664234Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/IncompleteSanitization.ql" : { },
2023-03-21T08:40:19.2665204Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-116/BadTagFilter.ql" : { },
2023-03-21T08:40:19.2665810Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-611/Xxe.ql" : { },
2023-03-21T08:40:19.2666437Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-730/RegExpInjection.ql" : { },
2023-03-21T08:40:19.2667096Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-730/ServerCrash.ql" : { },
2023-03-21T08:40:19.2667732Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-312/CleartextLogging.ql" : { },
2023-03-21T08:40:19.2668349Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-312/CleartextStorage.ql" : { },
2023-03-21T08:40:19.2668999Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-312/BuildArtifactLeak.ql" : { },
2023-03-21T08:40:19.2669633Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-829/InsecureDownload.ql" : { },
2023-03-21T08:40:19.2670271Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-089/SqlInjection.ql" : { },
2023-03-21T08:40:19.2670906Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-134/TaintedFormatString.ql" : { },
2023-03-21T08:40:19.2671585Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-346/CorsMisconfigurationForCredentials.ql" : { },
2023-03-21T08:40:19.2672305Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-300/InsecureDependencyResolution.ql" : { },
2023-03-21T08:40:19.2672972Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-209/StackTraceExposure.ql" : { },
2023-03-21T08:40:19.2673604Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-918/RequestForgery.ql" : { },
2023-03-21T08:40:19.2674293Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql" : { },
2023-03-21T08:40:19.2674975Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-347/MissingJWTKeyVerification.ql" : { },
2023-03-21T08:40:19.2675647Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/UnsafeHtmlConstruction.ql" : { },
2023-03-21T08:40:19.2676267Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/Xss.ql" : { },
2023-03-21T08:40:19.2676879Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/XssThroughDom.ql" : { },
2023-03-21T08:40:19.2677473Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/ReflectedXss.ql" : { },
2023-03-21T08:40:19.2678481Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/UnsafeJQueryPlugin.ql" : { },
2023-03-21T08:40:19.2679113Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/ExceptionXss.ql" : { },
2023-03-21T08:40:19.2679721Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-079/StoredXss.ql" : { },
2023-03-21T08:40:19.2680443Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-614/ClearTextCookie.ql" : { },
2023-03-21T08:40:19.2681081Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Security/CWE-326/InsufficientKeySize.ql" : { },
2023-03-21T08:40:19.2681712Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/AngularJS/DoubleCompilation.ql" : { },
2023-03-21T08:40:19.2682355Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/AngularJS/InsecureUrlWhitelist.ql" : { },
2023-03-21T08:40:19.2682946Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/AngularJS/DisablingSce.ql" : { },
2023-03-21T08:40:19.2683567Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Performance/PolynomialReDoS.ql" : { },
2023-03-21T08:40:19.2684178Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Performance/ReDoS.ql" : { },
2023-03-21T08:40:19.2684821Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Diagnostics/SuccessfullyExtractedFiles.ql" : { },
2023-03-21T08:40:19.2685460Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Diagnostics/ExtractionErrors.ql" : { },
2023-03-21T08:40:19.2686085Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Summary/LinesOfUserCode.ql" : { },
2023-03-21T08:40:19.2686685Z       "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/qlpacks/codeql/javascript-queries/0.5.4/Summary/LinesOfCode.ql" : { }
2023-03-21T08:40:19.2687013Z     }
2023-03-21T08:40:19.2687180Z   },
2023-03-21T08:40:19.2687400Z   "noDeclaredLanguage" : { },
2023-03-21T08:40:19.2687678Z   "multipleDeclaredLanguages" : { }
2023-03-21T08:40:19.2695730Z }
2023-03-21T08:40:19.2949328Z [command]/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/codeql resolve languages --format=betterjson --extractor-options-verbosity=4
2023-03-21T08:40:20.3910823Z {
2023-03-21T08:40:20.3911457Z   "extractors" : {
2023-03-21T08:40:20.3912045Z     "ruby" : [
2023-03-21T08:40:20.3912332Z       {
2023-03-21T08:40:20.3913042Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/ruby"
2023-03-21T08:40:20.3913444Z       }
2023-03-21T08:40:20.3913612Z     ],
2023-03-21T08:40:20.3913803Z     "go" : [
2023-03-21T08:40:20.3914001Z       {
2023-03-21T08:40:20.3914345Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/go"
2023-03-21T08:40:20.3914626Z       }
2023-03-21T08:40:20.3914808Z     ],
2023-03-21T08:40:20.3914991Z     "properties" : [
2023-03-21T08:40:20.3915201Z       {
2023-03-21T08:40:20.3915590Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/properties"
2023-03-21T08:40:20.3915894Z       }
2023-03-21T08:40:20.3916059Z     ],
2023-03-21T08:40:20.3916245Z     "xml" : [
2023-03-21T08:40:20.3916418Z       {
2023-03-21T08:40:20.3916777Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/xml"
2023-03-21T08:40:20.3917052Z       }
2023-03-21T08:40:20.3917240Z     ],
2023-03-21T08:40:20.3917416Z     "python" : [
2023-03-21T08:40:20.3917616Z       {
2023-03-21T08:40:20.3957429Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/python"
2023-03-21T08:40:20.3957965Z       }
2023-03-21T08:40:20.3958163Z     ],
2023-03-21T08:40:20.3958367Z     "cpp" : [
2023-03-21T08:40:20.3958552Z       {
2023-03-21T08:40:20.3958970Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/cpp"
2023-03-21T08:40:20.3959255Z       }
2023-03-21T08:40:20.3959421Z     ],
2023-03-21T08:40:20.3959625Z     "javascript" : [
2023-03-21T08:40:20.3959836Z       {
2023-03-21T08:40:20.3960409Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/javascript",
2023-03-21T08:40:20.3960734Z         "extractor_options" : {
2023-03-21T08:40:20.3960962Z           "trap" : {
2023-03-21T08:40:20.3961182Z             "title" : "TRAP options",
2023-03-21T08:40:20.3961506Z             "description" : "Options about how the extractor handles TRAP files",
2023-03-21T08:40:20.3961813Z             "type" : "object",
2023-03-21T08:40:20.3962039Z             "visibility" : 3,
2023-03-21T08:40:20.3962306Z             "properties" : {
2023-03-21T08:40:20.3962536Z               "cache" : {
2023-03-21T08:40:20.3962767Z                 "title" : "TRAP cache options",
2023-03-21T08:40:20.3963104Z                 "description" : "Options about how the extractor handles its TRAP cache",
2023-03-21T08:40:20.3963410Z                 "type" : "object",
2023-03-21T08:40:20.3963654Z                 "properties" : {
2023-03-21T08:40:20.3963884Z                   "dir" : {
2023-03-21T08:40:20.3964126Z                     "title" : "TRAP cache directory",
2023-03-21T08:40:20.3964450Z                     "description" : "The directory of the TRAP cache to use",
2023-03-21T08:40:20.3964729Z                     "type" : "string"
2023-03-21T08:40:20.3964944Z                   },
2023-03-21T08:40:20.3965132Z                   "bound" : {
2023-03-21T08:40:20.3965376Z                     "title" : "TRAP cache bound",
2023-03-21T08:40:20.3965691Z                     "description" : "A soft limit (in MB) on the size of the TRAP cache",
2023-03-21T08:40:20.3965966Z                     "type" : "string",
2023-03-21T08:40:20.3966265Z                     "pattern" : "[0-9]+"
2023-03-21T08:40:20.3966486Z                   },
2023-03-21T08:40:20.3966671Z                   "write" : {
2023-03-21T08:40:20.3966924Z                     "title" : "TRAP cache writeable",
2023-03-21T08:40:20.3967255Z                     "description" : "Whether to write to the TRAP cache as well as reading it",
2023-03-21T08:40:20.3967536Z                     "type" : "string",
2023-03-21T08:40:20.3967806Z                     "pattern" : "(true|TRUE|false|FALSE)"
2023-03-21T08:40:20.3968042Z                   }
2023-03-21T08:40:20.3968239Z                 }
2023-03-21T08:40:20.3968816Z               }
2023-03-21T08:40:20.3969015Z             }
2023-03-21T08:40:20.3969188Z           }
2023-03-21T08:40:20.3969382Z         }
2023-03-21T08:40:20.3969567Z       }
2023-03-21T08:40:20.3969740Z     ],
2023-03-21T08:40:20.3969928Z     "html" : [
2023-03-21T08:40:20.3970118Z       {
2023-03-21T08:40:20.3970495Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/html"
2023-03-21T08:40:20.3970771Z       }
2023-03-21T08:40:20.3970950Z     ],
2023-03-21T08:40:20.3971131Z     "java" : [
2023-03-21T08:40:20.3971299Z       {
2023-03-21T08:40:20.3971650Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/java",
2023-03-21T08:40:20.3971945Z         "extractor_options" : {
2023-03-21T08:40:20.3972156Z           "exclude" : {
2023-03-21T08:40:20.3972436Z             "title" : "A glob excluding files from analysis.",
2023-03-21T08:40:20.3972790Z             "description" : "A glob indicating what files to exclude from the analysis.\n",
2023-03-21T08:40:20.3973072Z             "type" : "string"
2023-03-21T08:40:20.3973278Z           }
2023-03-21T08:40:20.3973469Z         }
2023-03-21T08:40:20.3973630Z       }
2023-03-21T08:40:20.3973808Z     ],
2023-03-21T08:40:20.3974152Z     "csharp" : [
2023-03-21T08:40:20.3974328Z       {
2023-03-21T08:40:20.3974696Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/csharp",
2023-03-21T08:40:20.3974996Z         "extractor_options" : {
2023-03-21T08:40:20.3975199Z           "trap" : {
2023-03-21T08:40:20.3975455Z             "title" : "Options pertaining to TRAP.",
2023-03-21T08:40:20.3975773Z             "description" : "Options pertaining to TRAP.",
2023-03-21T08:40:20.3976066Z             "type" : "object",
2023-03-21T08:40:20.3976297Z             "properties" : {
2023-03-21T08:40:20.3976662Z               "compression" : {
2023-03-21T08:40:20.3976965Z                 "title" : "Controls compression for the TRAP files written by the extractor.",
2023-03-21T08:40:20.3977717Z                 "description" : "This option is only intended for use in debugging the extractor. Accepted values are 'brotli' (the default, to write brotli-compressed TRAP), 'gzip', and 'none' (to write uncompressed TRAP).\n",
2023-03-21T08:40:20.3978365Z                 "type" : "string",
2023-03-21T08:40:20.3978619Z                 "pattern" : "^(none|gzip|brotli)$"
2023-03-21T08:40:20.3978858Z               }
2023-03-21T08:40:20.3979032Z             }
2023-03-21T08:40:20.3979218Z           },
2023-03-21T08:40:20.3979424Z           "buildless" : {
2023-03-21T08:40:20.3979696Z             "title" : "Whether to use buildless (standalone) extraction.",
2023-03-21T08:40:20.3980800Z             "description" : "A value indicating, which type of extraction the autobuilder should perform. If 'true', then the standalone extractor will be used, otherwise tracing extraction will be performed. The default is 'false'. Note that buildless extraction will generally yield less accurate analysis results, and should only be used in cases where it is not possible to build the code (for example if it uses inaccessible dependencies).\n",
2023-03-21T08:40:20.3981484Z             "type" : "string",
2023-03-21T08:40:20.3981724Z             "pattern" : "^(false|true)$"
2023-03-21T08:40:20.3981931Z           },
2023-03-21T08:40:20.3982124Z           "cil" : {
2023-03-21T08:40:20.3982382Z             "title" : "Whether to enable CIL extraction.",
2023-03-21T08:40:20.3982839Z             "description" : "A value indicating, whether CIL extraction should be enabled. The default is 'true'.\n",
2023-03-21T08:40:20.3983166Z             "type" : "string",
2023-03-21T08:40:20.3983405Z             "pattern" : "^(false|true)$"
2023-03-21T08:40:20.3983606Z           }
2023-03-21T08:40:20.3983797Z         }
2023-03-21T08:40:20.3983989Z       }
2023-03-21T08:40:20.3984156Z     ],
2023-03-21T08:40:20.3984343Z     "csv" : [
2023-03-21T08:40:20.3984533Z       {
2023-03-21T08:40:20.3984880Z         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/csv"
2023-03-21T08:40:20.3985152Z       }
2023-03-21T08:40:20.3985331Z     ]
2023-03-21T08:40:20.3985493Z   }
2023-03-21T08:40:20.3985671Z }
2023-03-21T08:40:20.4087350Z Found 1 languages that support TRAP caching
2023-03-21T08:40:20.4087761Z Analyzing default branch. Skipping downloading of TRAP caches.
2023-03-21T08:40:20.4088754Z Code Scanning configuration file being processed in the codeql CLI.
2023-03-21T08:40:20.4094815Z ##[endgroup]
2023-03-21T08:40:20.4114535Z Writing augmented user configuration file to /home/runner/work/_temp/user-config.yaml
2023-03-21T08:40:20.4115044Z ##[group]Augmented user configuration file contents
2023-03-21T08:40:20.4121046Z {}
2023-03-21T08:40:20.4121169Z 
2023-03-21T08:40:20.4121416Z ##[endgroup]
2023-03-21T08:40:20.4128198Z [command]/opt/hostedtoolcache/CodeQL/2.12.4-20230304/x64/codeql/codeql database init --db-cluster /home/runner/work/_temp/codeql_databases --source-root=/home/runner/work/geoapi.pt/geoapi.pt --language=javascript --codescanning-config=/home/runner/work/_temp/user-config.yaml
2023-03-21T08:40:22.8213793Z Calculating baseline information in /home/runner/work/geoapi.pt/geoapi.pt
2023-03-21T08:42:32.4658194Z ##[error]The runner has received a shutdown signal. This can happen when the runner service is stopped, or a manually started runner is canceled.
2023-03-21T08:42:32.9644013Z Cleaning up orphan processes

Any possible solution?

[aibaars]

The last bit of the log says:

2023-03-21T08:40:22.8213793Z Calculating baseline information in /home/runner/work/geoapi.pt/geoapi.pt
2023-03-21T08:42:32.4658194Z ##[error]The runner has received a shutdown signal. This can happen when the runner service is stopped, or a manually started runner is canceled.
2023-03-21T08:42:32.9644013Z Cleaning up orphan processes

I wonder why the runner received a shutdown signal. The job only ran for a few minutes, so it can't be due reaching the time limit. Another possibility is that the system is running low on memory causing it to shutdown some processes to clear up RAM. I wouldn't expect the Calculating baseline information step to use a lot of memory. It's just counting line numbers, but you said it was a very large repo.

Let's try skipping the "baseline calculation" by adding the following environment variable to the workflow:

env:
  CODEQL_ACTION_EXTRA_OPTIONS: '{"database": { "init": ["--no-calculate-baseline"] } }'

[jfoclpf]

It worked, thank you.

btw, to avoid further memory problems, how do I restrict the scanning only to one directory? I tried to put paths at the root of the YAML codeql.yml as docs suugested, but didn't work

[aibaars]

btw, to avoid further memory problems, how do I restrict the scanning only to one directory? I tried to put paths at the root of the YAML codeql.yml as docs suugested, but didn't work

Did you specify the paths (or paths-ignore) property in a separate CodeQL configuration file? See also :

• https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#using-a-custom-configuration-file
• https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#specifying-directories-to-scan

[jfoclpf]

ah, ok, got it, the paths must be specified in a separate CodeQL configuration file, thanks for the info, I thought I could define them directly in the Github CodeQL action

[aibaars]

@jfoclpf There is actually a PR to allow just that: #1590 and #1589.