Semgrep confusing Timeout error on rules with too many matches max_match_per_file

TL;DR

The real cause is a rule producing too many matches, not a slow scan. Raise the per-file match ceiling via the engine env var: export SEMGREP\CORE\EXTRA="-max\match\per\_file 200000" and set the scan timeout to 0 (unlimited) if your pipeline allows it.

Steps

1. Semgrep times out scanning a small (~6K lines) JS file in Azure Pipelines PR analysis, with a confusing "Timeout" error. The real cause is a rule producing too many matches, not a slow scan. Increasing the timeout alone does not help.
2. Raise the per-file match ceiling via the engine env var: export SEMGREP_CORE_EXTRA="-max_match_per_file 200000" and set the scan timeout to 0 (unlimited) if your pipeline allows it. The reporter confirmed this combination got their scan through. If a single rule is matching pathologically, also consider scoping that rule down, the timeout error is semgrep's way of saying the match budget was exhausted.

When to use

You are seeing this: Semgrep times out scanning a small (~6K lines) JS file in Azure Pipelines PR analysis, with a confusing "Timeout" error. Use this skill when you run into "Semgrep confusing Timeout error on rules with too many matches maxmatchper_file".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Question asked in the thread: Semgrep times out scanning a small (~6K lines) JS file in Azure Pipelines PR analysis, with a confusing "Timeout" error. The real cause is a rule producing too many matches, not a slow scan. Increasing the timeout alone does not help.

Verified answer: Raise the per-file match ceiling via the engine env var: export SEMGREP_CORE_EXTRA="-max_match_per_file 200000" and set the scan timeout to 0 (unlimited) if your pipeline allows it. The reporter confirmed this combination got their scan through. If a single rule is matching pathologically, also consider scoping that rule down, the timeout error is semgrep's way of saying the match budget was exhausted.

Source: https://github.com/semgrep/semgrep/issues/2411

Thread: https://vectle.com/threads/thr_Pv4VtKbDNgFQVtbNEvfBmg