From 8a9ceff32de8b6543eb4f2e8393d70fb16bcb51e Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Fri, 21 Aug 2026 11:07:28 +0000 Subject: [PATCH] =?UTF-8?q?chore:=20exclude=20the=20two=20P/Invoke=20audit?= =?UTF-8?q?=20queries=20in=20codeql.yml=20(Standards=20=C2=A74.4)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adopts the revised canonical codeql.yml (standards PR #18): a query-filters block excluding cs/unmanaged-code and cs/call-to-unmanaged-code. These audit queries fire on every P/Invoke into the Keychain/libsecret/DPAPI backends and no code change resolves them (native interop is the point). Excluding exactly those two — every other security-and-quality query still runs on the interop files — is a genuine config fix that replaces the per-alert dismissals, which reopened whenever a reformat shifted line numbers. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/codeql.yml | 14 ++++++++++++++ CHANGELOG.md | 8 ++++++++ 2 files changed, 22 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7177a68..4e37bc7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,10 +49,24 @@ jobs: # Analyse source only. obj/ and bin/ hold generated and compiled # output — e.g. the xUnit auto-generated entry point — so findings # there are noise against code no human maintains. + # + # query-filters excludes the two audit queries that fire on every + # P/Invoke declaration and call site (cs/unmanaged-code, + # cs/call-to-unmanaged-code). Native-backend packages (Keychain, + # libsecret, DPAPI) exist to call unmanaged code, so these are pure + # noise there and non-native repos have no P/Invoke for them to hit. + # This excludes ONLY those two queries — every other + # security-and-quality query still runs on the interop files, so no + # real finding is lost (STANDARD.md 4.4). config: | paths-ignore: - "**/obj/**" - "**/bin/**" + query-filters: + - exclude: + id: cs/unmanaged-code + - exclude: + id: cs/call-to-unmanaged-code # Explicit build rather than autobuild: these repos multi-target, and # autobuild has picked a single TFM in the past, silently analysing half diff --git a/CHANGELOG.md b/CHANGELOG.md index ca5e36e..3e20b2c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- **CodeQL now excludes the two P/Invoke audit queries at the config level** (NextIteration.Standards + §4.4). A `query-filters` block in `codeql.yml` excludes exactly `cs/unmanaged-code` and + `cs/call-to-unmanaged-code` — audit queries that fire on every P/Invoke into Keychain, + libsecret, and DPAPI and that no code change can resolve (native interop is the point). + Every other `security-and-quality` query still runs on the interop files, so no real + finding is lost. This replaces the per-alert *won't fix* dismissals, which reopened + whenever a reformat shifted a line number. + - **Enabled `EnforceCodeStyleInBuild`** (NextIteration.Standards §1.2.1, now a `MUST`). The canonical `.editorconfig`'s gated rules now fail the build instead of merely showing in the IDE, so the house style is enforced. Bringing the code green under the flag was a