UnsupportedOperationException combining SARIF files

[dpogue]

Following #2658 being resolved, I'm getting an UnsupportedOperationException failure when it tries to combine and report the code scanning results.

My GitHub Actions workflow looks like this:

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: javascript, actions
        queries: security-and-quality

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3

This is the error message I see in in the "Perform CodeQL Analysis" step:

Uploading results
  Processing sarif files: ["/home/runner/work/myrepo/results/actions.sarif","/home/runner/work/myrepo/results/javascript.sarif"]
  Validating /home/runner/work/myrepo/results/actions.sarif
  Validating /home/runner/work/myrepo/results/javascript.sarif
  Combining SARIF files using the CodeQL CLI
  /opt/hostedtoolcache/CodeQL/2.20.1/x64/codeql/codeql github merge-results --output /home/runner/work/_temp/combined-sarif/output-VA2Fim/combined-sarif.sarif --sarif /home/runner/work/myrepo/results/actions.sarif --sarif /home/runner/work/myrepo/results/javascript.sarif --sarif-merge-runs-from-equal-category
  Oops! A fatal internal error occurred. Details:
  java.lang.UnsupportedOperationException
  	at java.base/java.util.AbstractList.add(Unknown Source)
  	at java.base/java.util.AbstractList.add(Unknown Source)
  	at java.base/java.util.AbstractCollection.addAll(Unknown Source)
  	at com.semmle.cli2.github.SarifRunsMerger.combineRuns(SarifRunsMerger.java:215)
  	at com.semmle.cli2.github.SarifRunsMerger.lambda$merge$1(SarifRunsMerger.java:59)
  	at java.base/java.util.HashMap.merge(Unknown Source)
  	at com.semmle.cli2.github.SarifRunsMerger.merge(SarifRunsMerger.java:58)
  	at com.semmle.cli2.github.GithubMergeResultsCommand.executeSubcommand(GithubMergeResultsCommand.java:37)
  	at com.semmle.cli2.picocli.SubcommandCommon.lambda$executeSubcommandWithMessages$5(SubcommandCommon.java:892)
  	at com.semmle.cli2.picocli.SubcommandCommon.withCompilationMessages(SubcommandCommon.java:444)
  	at com.semmle.cli2.picocli.SubcommandCommon.executeSubcommandWithMessages(SubcommandCommon.java:890)
  	at com.semmle.cli2.picocli.SubcommandCommon.toplevelMain(SubcommandCommon.java:777)
  	at com.semmle.cli2.picocli.SubcommandCommon.call(SubcommandCommon.java:757)
  	at com.semmle.cli2.picocli.SubcommandMaker.runMain(SubcommandMaker.java:238)
  	at com.semmle.cli2.picocli.SubcommandMaker.runMain(SubcommandMaker.java:259)
  	at com.semmle.cli2.CodeQL.main(CodeQL.java:115)

[aeisenberg]

Thanks for reporting. I see what the issue is and I will produce a fix. I'll also discuss internally to see if there is a workaround that you can use before this fix is available.

[aeisenberg]

We have a fix for this that will be available in v2.20.2 of the CLI. It is expected to be released on January 23.