data_extensions:
  - .github/codeql/extensions/safeLog.model.yml

# End-to-end Playwright specs are test-harness code, not shipped product code.
# They seed fixture files directly into the backend's COMPOSE_DIR (a fixed path
# under /tmp: both the spec fallback and the CI start-app default are
# /tmp/compose) so the API under test can read them back, which CodeQL flags as
# js/insecure-temporary-file. A randomized mkdtemp does not apply: the backend
# resolves paths against its own COMPOSE_DIR, so a fixture written elsewhere
# would be invisible to it, and the predictable-temp-path threat is moot on the
# ephemeral, single-tenant CI runners. paths-ignore is used (not a query-filters
# entry) because only paths-ignore scopes analysis by source path; a paths key
# inside a query-filters exclude is ignored, since query-filters match on query
# metadata rather than file location.
paths-ignore:
  - e2e/**

query-filters:
  # API tokens are 256-bit CSPRNG random; sha256 of the raw token is the
  # correct construction. js/insufficient-password-hash exists to catch weak
  # hashing of low-entropy human passwords, which is irrelevant for these
  # high-entropy opaque keys. Scoped to the token-handling files only, so
  # real user-password code (bcrypt-hashed elsewhere) is still analyzed.
  - exclude:
      id: js/insufficient-password-hash
      paths:
        - backend/src/utils/apiTokenFormat.ts
        - backend/src/routes/apiTokens.ts
        - backend/src/__tests__/**

  # registry-api.ts resolves image references parsed from admin-controlled
  # compose files into Docker registry manifest URLs. CodeQL traces the file
  # data into the outbound HTTPS request and flags it as a request-forgery
  # risk. Sencho is single-tenant and self-hosted: the admin who writes the
  # compose files owns the server, and specifying arbitrary registries is the
  # intended behavior. probeManifestForRef guards against URL-injection
  # characters in tag/repo components before constructing the URL; the
  # remaining taint path is inherent to the product's design rather than a
  # vulnerability. Excluding this file so the query still catches real SSRF
  # from untrusted multi-tenant or external input elsewhere.
  - exclude:
      id: js/request-forgery
      paths:
        - backend/src/services/registry-api.ts