Anso a3033a848e ci: scope CodeQL e2e tmpfile suppression via paths-ignore (#1346) ...

The js/insecure-temporary-file rule fires on e2e Playwright specs that
seed fixtures into the backend's COMPOSE_DIR (a fixed /tmp path) so the
API under test can read them back. A randomized mkdtemp cannot apply
there: the backend resolves paths against its own COMPOSE_DIR, so a
fixture written elsewhere would be invisible to it.

The prior suppression used a paths key inside a query-filters exclude,
which CodeQL ignores: query-filters match on query metadata, not source
path. That left the rule firing on every new e2e spec. Move the
exclusion to a top-level paths-ignore, the only mechanism that scopes
analysis by source path, so the e2e specs stop tripping the rule.

2026-06-09 21:52:27 -04:00

..

extensions

fix: add CodeQL barrier model for sanitizeForLog against log injection (#935)

2026-05-06 08:47:34 -04:00

codeql-config.yml

ci: scope CodeQL e2e tmpfile suppression via paths-ignore (#1346)

2026-06-09 21:52:27 -04:00