Summary

When a PR's unified diff exceeds GitHub's 20,000-line API limit, the action silently reports 0 findings instead of surfacing the error. The GitHub Actions UI shows a green checkmark, making it appear the PR was scanned and is clean when in reality no analysis occurred.

Reproduction

1. Open a PR with a large diff (e.g., 8,500+ additions / 2,000+ deletions across ~68 files)
2. The action runs and the GitHub API returns HTTP 406:

   Sorry, the diff exceeded the maximum number of lines (20000)
   

3. The action logs ##[warning]ClaudeCode exited with code 1 but continues
4. Sets CLAUDECODE_FINDINGS: 0 and completes successfully
5. No PR comment, no findings artifact, no indication that the scan failed

Observed behavior

From our run:

##[warning]ClaudeCode exited with code 1
ClaudeCode results file size: 136 bytes
CLAUDECODE_FINDINGS: 0
Could not read findings file

The PR (68 files, ~10,500 lines changed) never exceeded GitHub's file count limit but the unified diff with context lines pushes past the 20K line cap on the Get a pull request endpoint when requesting application/vnd.github.v3.diff.

Expected behavior

At minimum:

• Surface the error clearly — set the check status to "neutral" or "failure" with an annotation like "PR diff too large for GitHub API (20,000 line limit). Security review skipped."
• Post a PR comment explaining the scan was skipped due to diff size

Ideally:

• Fall back to local git diff — the action already checks out the code with fetch-depth: 2. Using git diff HEAD~1 or git diff origin/main...HEAD locally would bypass the API limit entirely and allow scanning large PRs

Related

• Running security review on Github Actions doesn't result in PR comments OR any output #63 — similar silent failure (no output, no comments) on large PRs
• Fix #63: Fail CI when review does not complete (e.g. token limit) #64 — request to fail CI when review does not complete

Environment

• Action ref: 0c6a49f1fa56a1d472575da86a94dbc1edb78eda (main)
• Runner: ubuntu-latest
• PR stats: 68 files, 8,529 additions, 2,028 deletions