Repository navigation
ci(codeql): advanced setup that skips proving-ground tasks and fixtures - #21
Merged
Merged
Conversation
Default setup cannot ignore paths, so every new suite's deliberately flawed starting repos and test harnesses opened alerts (25 on the OAuth and web suites). Same default query suite, same languages, SHA-pinned like the rest of CI.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL default setup cannot ignore paths. Every proof suite adds deliberately imperfect starting repos, test harnesses and reference solutions that only ever run inside the lab sandbox, and CodeQL flags them. #17 (OAuth) and #19 (web) brought 25 such alerts, all under
tasks/: HTML-stripping helpers in Next.js test harnesses, prototype-pollution warnings on the toy database of a starting repo, and rate-limit and CSRF heuristics on a demo OIDC login app.This moves CodeQL to an advanced workflow with the same default query suite and the same languages (
actions,javascript-typescript). It runs on PRs, on main and weekly, is SHA-pinned like the rest of CI, and has least-privilege permissions..github/codeql/codeql-config.ymlignorestasks/,site/fixtures/andpackages/sigil/test/fixtures/. Capability content keeps its own scanner job ("Scan the catalog").Before merging: default setup has to be switched off, or GitHub rejects the advanced upload. Settings → Code security → CodeQL analysis → Switch to advanced, or:
Then re-run this PR's checks, merge it, and re-run CodeQL on #17 and #19.