ci(codeql): exclude py/log-injection, which exceeds the 2 GiB result limit

[devin-ai-integration]

TLDR

Problem this solves:

• Analyze (python) CodeQL job fails on every push to main
• Same query, py/log-injection, exceeds CodeQL's 2 GiB result-set limit each time
• Failing since at least March 2026, 300+ consecutive red runs on main
• Diff-informed PR runs mostly pass, but a few PRs a day still go red for the same reason (feat(ui): add upgrade banner with latest release changelog stats #40429, feat(mcp): list MCP prompts and resources in the admin UI #41900, feat(auth): breached password detection, self-service change-password and forced password reset #42278)

How it solves it:

• Excludes py/log-injection in .github/codeql/codeql-config.yml, next to the two queries already excluded for the same blowup
• The other 167 python queries keep running and can now actually report

User Flow

Before: a contributor's PR shows a red CodeQL check that has nothing to do with their change

1. They open https://github.com/BerriAI/litellm/pull/40429/checks and see Analyze (python) failed
2. The log ends with Query failed: codeql/python-queries/Security/CWE-117/LogInjection.ql (Result set is larger than the limit of 2GiB) and exit code 34
3. They open https://github.com/BerriAI/litellm/actions/workflows/codeql.yml?query=branch%3Amain and every main run is red the same way, so the failure tells them nothing

After: the CodeQL check finishes and only goes red when a query finds something

1. They open the checks page for their PR and Analyze (python) is green
2. https://github.com/BerriAI/litellm/actions/workflows/codeql.yml?query=branch%3Amain shows green runs, so a red run now means a real finding

Relevant issues

Affected release

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests (n/a, CI config only)
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Before (ecba48d, current main)

1. gh run list --workflow codeql.yml --branch main --event push --limit 200 --json conclusion --jq '[.[] | select(.conclusion=="success" or .conclusion=="failure")] | group_by(.conclusion) | map({(.[0].conclusion): length}) | add'
2. {"failure":119} (zero successful push runs in the last 200)
3. gh run view 35641153989 --log-failed | grep "Query failed"
4. [168/168 eval 10m43s] Query failed: codeql/python-queries/Security/CWE-117/LogInjection.ql (Result set is larger than the limit of 2GiB).

After (3d94d2b)

1. The Analyze (python) check on this PR: it is the same job with the exclusion applied, link below once the run finishes

Type

🚄 Infrastructure

Caveats (if any)

Medium

• No log-injection coverage from CodeQL, same as today in practice: the query has not produced a result on main since at least March
• ci(codeql): exclude noisy Python quality queries #41142 added this exact exclude and then dropped it again in 15fdc5f to "retain coverage"; this PR argues that coverage was never real

Low

• Reason the 2 GiB blowup happens on some PR runs but not others is a hypothesis (sinks in the diff that log str(exception) keep a huge path set alive under diff-informed pruning), not proven. The exclude fixes both the main and PR failures regardless

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/d1426f073d0247599869ad3dc00ac65e
Open in Devin Desktop: https://app.devin.ai/desktop/session/d1426f073d0247599869ad3dc00ac65e?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the configuration is correctly wired and implements the documented CodeQL exclusion without affecting the remaining queries.

Summary

This PR excludes the Python log-injection query from CodeQL because its oversized result set repeatedly prevents Python analysis from completing.

• Adds py/log-injection to the existing CodeQL query exclusions.
• Preserves the remaining Python security-and-quality queries.
• Updates the adjacent explanation to cover all excluded scaling-heavy queries.

_{Reviews (1) · Last reviewed commit: "ci(codeql): exclude py/log-injection, wh..."}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!