From 884838bfbc48493a156ffbd49ca2de14db2cc543 Mon Sep 17 00:00:00 2001
From: Diogo Esteves <diogo.esteves.goncalves@gmail.com>
Date: Mon, 2 Nov 2026 09:14:07 +0000
Subject: [PATCH] ci(codeql): advanced setup that skips proving-ground tasks
 and fixtures

Default setup cannot ignore paths, so every new suite's deliberately
flawed starting repos and test harnesses opened alerts (25 on the OAuth
and web suites). Same default query suite, same languages, SHA-pinned
like the rest of CI.
---
 .github/codeql/codeql-config.yml | 10 ++++++++
 .github/workflows/codeql.yml     | 40 ++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 .github/codeql/codeql-config.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..df30887
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,10 @@
+name: Sigil CodeQL
+
+# CodeQL covers the code Sigil ships: the CLI, the site and the workflows. Proving-ground tasks are
+# deliberately flawed starting repos, hidden verifiers and reference solutions that only ever run
+# inside the lab sandbox, and fixtures are test data; flagging them is noise that grows with every
+# suite. Capabilities are scanned by Sigil's own scanner in CI ("Scan the catalog").
+paths-ignore:
+  - tasks
+  - site/fixtures
+  - packages/sigil/test/fixtures
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..bc1bedb
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:${{ matrix.language }}