From 29f1757a4c245024b42183c5e0b89bb1c0cd3383 Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Thu, 20 Aug 2026 17:00:31 +0000 Subject: [PATCH] ci: exclude obj/ and bin/ from CodeQL analysis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security-and-quality suite raises note-level findings against generated and compiled output — the xUnit auto-generated entry point in obj/ among them. Add a paths-ignore for **/obj/** and **/bin/** so analysis covers only code a human maintains. Matches the NextIteration.Standards template. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/codeql.yml | 7 +++++++ CHANGELOG.md | 4 +++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f7cad91..7177a68 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,6 +46,13 @@ jobs: # security-and-quality is broader than the default security-extended; # these are small libraries, so the extra findings are affordable. queries: security-and-quality + # Analyse source only. obj/ and bin/ hold generated and compiled + # output — e.g. the xUnit auto-generated entry point — so findings + # there are noise against code no human maintains. + config: | + paths-ignore: + - "**/obj/**" + - "**/bin/**" # Explicit build rather than autobuild: these repos multi-target, and # autobuild has picked a single TFM in the past, silently analysing half diff --git a/CHANGELOG.md b/CHANGELOG.md index dda90d1..597fbdc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -99,7 +99,9 @@ floor. ### Added - CodeQL code scanning (`security-and-quality` query pack), weekly plus on every - push and pull request. + push and pull request. Analysis excludes `**/obj/**` and `**/bin/**`, so generated + and compiled output — the xUnit auto-generated entry point among it — raises no + findings. - `SECURITY.md`, `CONTRIBUTING.md`, a pull request template, and a root `CLAUDE.md`. `SECURITY.md` states the scope this library does and does not claim — settings are stored as plain-text JSON and are explicitly not a place for secrets.