Observed failure
The stable Roslyn analyzer audit completes, but publishing its SARIF to code scanning fails schema validation because multiple runs contain duplicate invocations[0].ruleConfigurationOverrides entries.
At 2026-09-21T21:11:15Z, the Publish Roslyn analyzer results log reports:
Unable to upload "Artifacts/AnalyzerAudit/Roslyn/roslyn-analyzers.sarif" as it is not valid SARIF:
- instance.runs[0].invocations[0].ruleConfigurationOverrides contains duplicate item
- instance.runs[2].invocations[0].ruleConfigurationOverrides contains duplicate item
- instance.runs[3].invocations[0].ruleConfigurationOverrides contains duplicate item
The same diagnostic continues across many additional runs. The upload uses github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13.
Scope and evidence
Run Roslyn analyzer audit and Prepare Roslyn analyzer results both succeeded. .github/scripts/merge-analyzer-sarif.ps1 reads each input document, assigns an automation ID, and collects its runs into one output document. The logs establish a rejected final payload; they do not establish whether the duplicate configuration entries originate in compiler output or later processing.
The workflow, scripts, global SDK configuration, and root build/package configuration are unchanged from selected main 0bfd95e8561699b3bb7c619b0b0d2378d84395bc. The triggering successor adds four assertions/comment lines to a Journaling test; it changes no source consumed by the source-only analyzer audit relative to its parent.
The job also had a separate artifact-upload FinalizeArtifact HTTP 403, which is the failed step in job metadata. That existing service failure is tracked by #10961 and discussed in #11086, already inherited by this head. The SARIF publish step has continue-on-error: true, so its schema rejection must be distinguished from the job's artifact-upload failure. No product test failure is claimed.
Expected outcome
The analyzer audit should publish schema-valid SARIF and make its findings available in code scanning. Investigate the input and merged configuration-override arrays, preserve their intended configuration semantics, and add a focused regression check for valid output.
Exact-message, ruleConfigurationOverrides, and SARIF/duplicate issue and PR searches found no matching tracker or newer fix. #11164 concerns a different, unconfirmed compiler-output observation. No CI rerun or branch rebase was used to replace this evidence.
Observed failure
The stable Roslyn analyzer audit completes, but publishing its SARIF to code scanning fails schema validation because multiple runs contain duplicate
invocations[0].ruleConfigurationOverridesentries.901d42432a8e7daa1308aa7a232f02e3f1adc67aAt
2026-09-21T21:11:15Z, thePublish Roslyn analyzer resultslog reports:The same diagnostic continues across many additional runs. The upload uses
github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13.Scope and evidence
Run Roslyn analyzer auditandPrepare Roslyn analyzer resultsboth succeeded..github/scripts/merge-analyzer-sarif.ps1reads each input document, assigns an automation ID, and collects its runs into one output document. The logs establish a rejected final payload; they do not establish whether the duplicate configuration entries originate in compiler output or later processing.The workflow, scripts, global SDK configuration, and root build/package configuration are unchanged from selected main
0bfd95e8561699b3bb7c619b0b0d2378d84395bc. The triggering successor adds four assertions/comment lines to a Journaling test; it changes no source consumed by the source-only analyzer audit relative to its parent.The job also had a separate artifact-upload
FinalizeArtifactHTTP 403, which is the failed step in job metadata. That existing service failure is tracked by #10961 and discussed in #11086, already inherited by this head. The SARIF publish step hascontinue-on-error: true, so its schema rejection must be distinguished from the job's artifact-upload failure. No product test failure is claimed.Expected outcome
The analyzer audit should publish schema-valid SARIF and make its findings available in code scanning. Investigate the input and merged configuration-override arrays, preserve their intended configuration semantics, and add a focused regression check for valid output.
Exact-message,
ruleConfigurationOverrides, and SARIF/duplicate issue and PR searches found no matching tracker or newer fix. #11164 concerns a different, unconfirmed compiler-output observation. No CI rerun or branch rebase was used to replace this evidence.