Repository navigation
Expand file tree
/
Copy pathcodeql-config.yml
More file actions
35 lines (33 loc) · 1.53 KB
/
Copy pathcodeql-config.yml
File metadata and controls
35 lines (33 loc) · 1.53 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# CodeQL / GitHub code-scanning configuration.
#
# IMPORTANT: this repository currently runs code scanning via GitHub "default
# setup" (Settings -> Code security -> CodeQL analysis). Default setup does NOT
# read this config file, so the `paths-ignore` entries below only take effect
# once the repository is switched to an "advanced setup" CodeQL workflow (an
# admin toggle that cannot be done from a PR alone).
#
# They are kept here as the canonical, declared list of paths that are not worth
# scanning, so the exclusions apply automatically if/when advanced setup is
# adopted. Until then, real noise must be triaged in the UI by dismissing alerts
# as "Used in tests" / "Won't fix".
#
# The newer "GitHub Code Quality" preview (github-code-quality[bot]) does not yet
# support path exclusion at all; its false positives must also be dismissed in
# the UI for now.
name: "CodeQL config"
paths-ignore:
# Vendored third-party libraries we do not maintain.
- public/libs/**
# Vendored/generated math editor assets.
- public/app/common/fMath/**
# Test code and fixtures are never shipped to users.
# Deliberate trade-off: excluding test/** also removes any future test
# helpers that perform real I/O (filesystem, network, child processes) from
# CodeQL's scope, so genuine issues in such helpers will not be flagged here.
# This is accepted because test code is never shipped to end users; review
# test helpers manually if they touch untrusted input.
- "**/*.test.js"
- "**/*.spec.ts"
- test/**
# Minified bundles.
- "**/*.min.js"