From 7ee47a7ae8bc366b4bdb8c679bd2c95950f172f7 Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Thu, 20 Aug 2026 17:00:26 +0000 Subject: [PATCH] ci: exclude obj/ and bin/ from CodeQL analysis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security-and-quality suite raises note-level findings against generated and compiled output — the xUnit auto-generated entry point in obj/ among them. Add a paths-ignore for **/obj/** and **/bin/** so analysis covers only code a human maintains. Matches the NextIteration.Standards template. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/codeql.yml | 7 +++++++ CHANGELOG.md | 4 +++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f7cad91..7177a68 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,6 +46,13 @@ jobs: # security-and-quality is broader than the default security-extended; # these are small libraries, so the extra findings are affordable. queries: security-and-quality + # Analyse source only. obj/ and bin/ hold generated and compiled + # output — e.g. the xUnit auto-generated entry point — so findings + # there are noise against code no human maintains. + config: | + paths-ignore: + - "**/obj/**" + - "**/bin/**" # Explicit build rather than autobuild: these repos multi-target, and # autobuild has picked a single TFM in the past, silently analysing half diff --git a/CHANGELOG.md b/CHANGELOG.md index ddac09b..1f701f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,7 +26,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 single required status check, so the matrix can be reshaped without touching branch protection. Adds `codeql.yml` (§4.4), `dependabot.yml` (§4.6) and `dependabot-auto-merge.yml` (§4.7), plus per-workflow `concurrency`, - `timeout-minutes` and a NuGet restore cache (§3.5–3.7). + `timeout-minutes` and a NuGet restore cache (§3.5–3.7). CodeQL analysis excludes + `**/obj/**` and `**/bin/**`, so generated and compiled output — the xUnit + auto-generated entry point among it — raises no findings. - **Code coverage is collected** via `Microsoft.Testing.Extensions.CodeCoverage`, the Microsoft.Testing.Platform equivalent of coverlet (§2.6). CI invokes it and uploads the result per platform. Contributor-facing only; the collector is test-only and does