chore: align codeql.yml with buildless standard; resolve remaining scanning alerts - #17
Merged
Merged
Conversation
…ng alerts Align with the updated NextIteration.Standards §4.4 / §3.0.1 and resolve the three remaining open code-scanning alerts with genuine fixes. - codeql.yml now matches the canonical template verbatim (non-comment content): the C# analysis runs `build-mode: none`, dropping the Setup .NET / Restore / Build steps. This is load-bearing — GitHub honours the `paths-ignore` for **/obj/** and **/bin/** only under buildless extraction, so under the previous explicit build the exclusion was inert and the generated xUnit entry point in obj/ was analysed. This clears the audit-drift `3.0.1 workflow content` FAIL (the only failing clause) and genuinely excludes the two cs/missed-ternary-operator alerts against generated code. - cs/local-not-disposed: the previous fluent `new TestConsole().Interactive()` left CodeQL unable to connect the allocation to the disposed `using` variable, so the alert reopened. Bind `using` directly to `new TestConsole()` and call `.Interactive()` as a separate statement (it mutates in place and returns the same instance) so the disposal is visible to dataflow. audit-drift.sh (scoped to this repo): 32/32 clauses green after this change. Build clean (0 warnings); 64/64 tests pass on net8.0 and net10.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Merged
StuartMeeks
added a commit
that referenced
this pull request
Aug 22, 2026
Patch release — no consumer-visible API or runtime behaviour change. Bumps <Version> to 1.0.1 and finalises the CHANGELOG [1.0.1] section (dated 2026-08-22) from [Unreleased]. The shipped assembly carries only the behaviour-neutral internal refactors from #16 that cleared the CodeQL security-and-quality findings (Path.Join, narrowed catches, .Where(...), using(cts)); the remainder is CI-only (the #17 move to buildless CodeQL analysis). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns this repo with the latest NextIteration.Standards and resolves the three still-open code-scanning alerts with genuine fixes (no dismissals).
Standards alignment
audit-drift.sh(scoped to this repo) reported exactly one failing clause —3.0.1 workflow content— everything else green. The standards repo's latest change (analyse C# buildless so codeql paths-ignore applies, §4.4) updated the canonicalcodeql.yml; this brings the repo into line (the sanctioned "template first, then every repo" direction — the template already changed):codeql.ymlnow runs the C# analysis inbuild-mode: none(buildless extraction) and drops theSetup .NET/Restore/Buildsteps. Non-comment content now equals the template verbatim.This is load-bearing, not cosmetic: GitHub applies
paths-ignore(**/obj/**,**/bin/**) to a compiled language only under buildless extraction. Under the previous explicit build, every file the compiler saw was analysed —obj/included — so the exclusion was silently inert and the generated xUnit entry point was scanned.Code-scanning alerts resolved
cs/missed-ternary-operator×2 (inobj/**/XunitAutoGeneratedEntryPoint.cs) — now genuinely excluded becausepaths-ignorefinally takes effect underbuild-mode: none. These were stale-open against generated code no human maintains.cs/local-not-disposed×1 (CliHarness) — my earlier fix used a fluentusing var console = new TestConsole().Interactive(), but CodeQL flagged thenew TestConsole()allocation itself: dataflow couldn't connect the allocation (behind the extension call) to the disposed variable. Fixed by bindingusingdirectly tonew TestConsole()and calling.Interactive()as a separate statement (it mutates in place and returns the same instance).Verification
audit-drift.sh(this repo): 32/32 clauses green after the change.TreatWarningsAsErrors); 64/64 tests pass onnet8.0andnet10.0.Once merged and CodeQL re-scans
main, all open alerts should close.🤖 Generated with Claude Code