Copilot's `codeql_checker` always times out

[petealbertson]

I'm not sure if this is a duplicate of #12349, but when codeql_checker runs inside Copilot cloud sessions, it never succeeds. Every time it reports "Operation cancelled due to timeout. Do not re-run the codeql_checker tool because it will not complete successfully."

The repository I've experienced this on is private & primarily Ruby (on Rails). I never actually configured CodeQL to run on this repo as its own action, so it's only happening within the context of a Copilot cloud session, and therefor I cannot investigate logs specific to the CodeQL run. Let me know if there are ways to further debug or investigate why it times out. Otherwise it would be nice to know if I can turn off these CodeQL runs within Copilot to avoid the wasted resources.

[mbg]

Hi @petealbertson 👋🏻

Thanks for the report. This is unlikely to be related to the issue you linked. Copilot Coding Agent is designed to make use of CodeQL to check its intermediate work for security vulnerabilities. However, CodeQL analyses can take time for large or complex projects, and so there is a strict timeout imposed on this to prevent sessions from taking too long. That timeout means that the codeql_checker task may not always finish in the allocated time -- the timeout is quite a bit shorter than how CodeQL analyses can take. PRs generated by Copilot Coding Agent will obviously go through your normal CI checks once opened, so that any security scans you may have configured will run then in full.

We are actively working on improvements to both products. On the CodeQL side, we are working on improved incremental analysis, which we expect will speed up analyses for larger and more complex projects in the future. That could then (among other things) allow the codeql_checker task to complete in more cases.

I am not aware of any work to restrict Copilot Coding Agent to not attempt the CodeQL checks, but I can check with the team responsible for that. In general, even though the codeql_checker task may never finish for Copilot Coding Agent sessions on your repository, the outcome depends on the changes being analysed and could change with improvements we make to CodeQL.

[MikeGreenSainsburys]

Just commenting to say that I am experiencing the same issue too. Until recently, I had no issues with it. However, it now appears that most of my Copilot sessions fail on the codeql check. I have to now explicitly direct Copilot to not attempt a codeql check if I want my sessions to succeed.