fix(ci): Stabilize CodeQL check results

[jkowall]

Summary

• set an explicit CodeQL analysis category so reusable workflow uploads match the configuration names GitHub sees on main
• avoid preallocating Badger trace ID results with the request-derived search limit that CodeQL flagged as an uncontrolled allocation size

Root cause

The CodeQL workflow is invoked through the CI orchestrator, so GitHub generated PR analysis categories from .github/workflows/ci-orchestrator.yml while the baseline configurations on main were recorded under .github/workflows/codeql.yml. That produced the "configurations not found" warning even though the Go and Python CodeQL jobs completed successfully.

The same PR check also surfaced a high CodeQL alert in Badger storage because filterIDs used plan.limit, derived from query input, as the slice capacity.

Validation

• make fmt
• make lint
• make test

[Copilot]

Pull request overview

This PR stabilizes CodeQL check results in CI by making the analysis category deterministic across reusable workflow invocations, and addresses a CodeQL finding in Badger trace ID filtering by avoiding preallocation based on request-derived limits.

Changes:

• Add an explicit CodeQL category so uploaded SARIF results match the baseline configuration names on main.
• Remove request-derived slice preallocation in Badger trace ID filtering to avoid an “uncontrolled allocation size” CodeQL alert.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/storage/v1/badger/spanstore/reader.go	Avoids preallocating a result slice capacity from plan.limit when filtering trace IDs.
.github/workflows/codeql.yml	Sets an explicit CodeQL analysis category to stabilize configuration naming across workflow contexts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

CI Summary Report

Metrics Comparison

⚠️ 36 metric change(s) detected (informational)

View changed metrics

For label-level diff details, open the CI run and expand the "Compare metrics and generate summary" step logs.

metrics_snapshot_elasticsearch_8.x_e2e — ⬇️ download diff
3 added

• jaeger_storage_latency
• jaeger_storage_requests
• rpc_server_call_duration

Code Coverage

✅ Coverage 97.3% (baseline 97.3%)

➡️ View CI run | View publish logs
2026-05-22 12:17:50 UTC