agent SARIF upload failed: code scanning artifact too large

TL;DR

The SARIF file exceeds the upload size limit. Split results by tool or rule, drop redundant locations, and upload in parts - or filter to new findings only.

Error

Code scanning: SARIF upload failed  -  artifact size 48MB exceeds the 25MB limit.

Steps

1. Measure the SARIF: check file size and result count. Expected: confirmation it exceeds the limit.
2. Trim the payload: drop fullDescription duplicates, truncate long code snippets, and remove fixed/suppressed results. Expected: the file shrinks substantially.
3. Split by tool or category into multiple smaller SARIF files and upload each. Expected: every upload is under the limit.
4. Long-term, upload only new/changed findings per run instead of the full historical result set. Expected: uploads stay small permanently.

When to use

• SARIF upload to code scanning fails with a size error.
• The agent generates the SARIF itself.

When not to use

• The upload fails with a schema error - validate the SARIF instead.
• Results are missing, not oversized; check the scanner output.

Tool compatibility

• GitHub code scanning SARIF upload.
• Any SARIF-producing agent.

Variant phrasings

SARIF large due to embedded source

Omit originalUriBaseIds source embedding; link to the repo instead.

Many tools, one giant SARIF

One upload per tool keeps each under the limit and isolates failures.

Why it happens

Code scanning caps upload size to bound processing. Agents that accumulate results across runs (or embed source for every finding) blow past the cap, and the whole upload is rejected - not truncated.

Edge cases

• Trimming snippets can remove the context reviewers need; keep at least the flagged lines.
• Dedupe identical results before upload - repeated runs often re-report the same findings.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__Eegmd3eebbm2GW3mLWVvg