[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Closes #2130, taking option 1 as ruled there.

• Config: a new .github/codeql/codeql-config.yml with paths-ignore: [tests], referenced from codeql-analysis.yml's Initialize CodeQL step with config-file:.
• Why tests/: every recurring py/clear-text-logging-sensitive-data / -storage- alert in extraction.py and corekit/io.py traces, in main's SARIF, to a pcapkit test fixture's secrets names. Python is not built, so an ignored path is left out of the analysis. Both rules, and every other query, still run over pcapkit/.
• Not covered: the warnings.py alert starts at the library's own secrets_length field, so it still needs one manual dismissal.
• Tests: tests/project/test_codeql_config_2130.py pins that the init step passes exactly the config file and no inline config, and that the config holds only name and paths-ignore: ['tests']. It fails with the config removed, or with the earlier query-filters variant.
• Docs: a "CodeQL Configuration" section in workflows.rst.
• Unverified until it runs on main: that paths-ignore drops tests/ from the CodeQL database, and so closes the alerts. The GitHub docs say it excludes the files "from analysis"; the next analysis on main will show it.

[JarryShaw]

GOOD TO GO at 0b41a6b01 (Sonnet review).

• Format: config-file: and paths-ignore are valid for github/codeql-action/init at the pinned sha (init/action.yml, db-config-schema.json). No step passes an inline config, which would override the file.
• No real finding lost: no code-scanning alert in any state has ever been located under tests/. Every alert from these two rules sits in pcapkit/ and was dismissed as a false positive. The workflow-permission alerts are outside tests/.
• Tests: 59 passed across the CodeQL, pin, hardening and doc-reference tests. The workflow diff is two lines, and the language autodetect is unchanged.
• Unverified until the first analysis on main: the CodeQL CLI's translation of paths-ignore into the Python extractor's filters happens inside the closed-source CLI. The GitHub docs say the files are "excluded from analysis", and the extractor reads the filter. InfoClass instanciation calls os.stat, ruining performance #29 closing after the merge will confirm it; Remove .vscode once for good #27 still needs its one manual dismissal.

[github-actions]

Coverage: 91.55% (unit tier, Python 3.15, 0b41a6b01, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2589	75	816	37	96.48%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2971	23	1036	25	98.80%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17418	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	498	7	144	5	98.13%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 0b41a6b01.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS). The 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/project plain-unittest ordering leg passed on a scratch merge into main d7aa41535, with 2236 tests, 0 failures.

This closes #2130. Afterwards, the next CodeQL analysis on main should close #29. #27 still needs its one manual dismissal.