[Bug] GitHub's "update" broke all code review tools: `The CodeQL Action does not support uploading multiple SARIF runs with the same category. Please update your workflow to upload a single run per category.`

[SwuduSusuwu]

https://github.blog/changelog/2025-07-21-code-scanning-will-stop-combining-multiple-sarif-runs-uploaded-in-the-same-sarif-file/ is what did this.

The sole solution for now is to replace codacy-analysis-cli-action with a custom code review tool.

[SwuduSusuwu]

Was not sure if this issue should go to this or to the similar repo at codacy/codacy-analysis-cli#541

[mrlonis]

Any traction on this?

[chadsec1]

This is kinda ridiculous it hasn't been solved yet.

[ale5000-git]

This is my workaround:

      - name: "Codacy analysis"
        uses: codacy/codacy-analysis-cli-action@v4
        with:
          project-token: "${{ secrets.CODACY_PROJECT_TOKEN }}"
          output: "results.sarif"
          format: "sarif"
          gh-code-scanning-compat: true
          max-allowed-issues: 2147483647
          upload: false
      - name: "Combine all SARIF runs by tool name"
        shell: bash
        timeout-minutes: 5
        run: |
          # Combining all SARIF runs by tool name...
          jq '.runs |= (
            # Shorten tool driver name by replacing " (reported by " with " ("
            map(.tool.driver.name |= sub(" \\(reported by "; " (")) |
            # Group runs by tool name to create unique categories (Post-March 27, 2026 GitHub requirement)
            group_by(.tool.driver.name) |
            map(
              # Store the group and the first element (as template)
              . as $group |
              .[0] as $first |
              # Rebuild the run object by collecting data in a single pass
              $first + {
                # Collect all results and artifacts from the group, removing ruleIndex if it is -1
                "results": ([$group[].results[] | if .ruleIndex == -1 then del(.ruleIndex) else . end] | unique),
                "artifacts": ([$group[].artifacts[]] | unique),
                # Keep individual invocations and remove workingDirectory if it matches "file:///codacy"
                "invocations": ([$group[].invocations[] | if .workingDirectory.uri == "file:///codacy" then del(.workingDirectory) else . end])
              }
            )
          )' -- './results.sarif' 1> './results-combined.sarif'
      - name: "Upload SARIF results file to GitHub"
        uses: github/codeql-action/upload-sarif@v4
        timeout-minutes: 10
        if: "${{ github.ref == 'refs/heads/main' }}"
        with:
          token: "${{ github.token }}"
          sarif_file: "./results-combined.sarif"
          category: "Codacy"

[chadsec1]

@ale5000-git
Thanks but I'd still rather see upstream not being completely broken, instead of monkey patching it.. I will just wait until they fix it. hopefully they do quickly.