fix: resolve all four CodeQL findings + align codeql.yml to Standards (build-mode: none) - #15
Merged
Merged
Conversation
…ot-disposed) Replace the hand-rolled hex-digit range check in SplashColors.ValidateHex with char.IsAsciiHexDigit — same result, no complex condition, and the canonical BCL method on both net8.0 and net10.0. Dispose the two TestConsole instances in SplashScreenTests via `using`; TestConsole is IDisposable and both were leaking. Behaviour-preserving: no public API or rendered output changed. The two remaining open alerts are in xUnit's auto-generated obj/ entry point and are pending a Standards-level codeql.yml change (paths-ignore is inert for built C#). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| { | ||
| var prev = AnsiConsole.Console; | ||
| var test = new TestConsole().Width(120); | ||
| using var test = new TestConsole().Width(120); |
The explicit-build CodeQL workflow applied no path filter to the compiled C#, so the repo's paths-ignore: **/obj/** was inert and the xUnit auto-generated entry point in obj/ was analysed and flagged (two cs/missed-ternary-operator alerts). The updated §4.4 template switches to build-mode: none, under which buildless extraction honours paths-ignore, so the exclusion actually takes effect — and it reads source across all TFMs at once instead of one build's output. File is the template verbatim; Setup .NET / Restore / Build steps removed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
StuartMeeks
changed the title
This was referenced Aug 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resolves all four open CodeQL
security-and-qualityalerts with genuine fixes (no dismissals), and bringscodeql.ymlback in line with the updated NextIteration.Standards template.Source/test findings — fixed in code
cs/complex-condition(SplashColors.cs) — the hand-rolled(c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')hex-digit test is replaced bychar.IsAsciiHexDigit(c), the canonical BCL method (available on bothnet8.0andnet10.0).cs/local-not-disposed(SplashScreenTests.cs) — the twoTestConsoleinstances are now disposed viausing.TestConsoleisIDisposableand both were leaking.Generated-file findings — fixed by making the exclusion actually work
cs/missed-ternary-operator×2, in xUnit v3's auto-generatedobj/Release/**/XunitAutoGeneratedEntryPoint.cs. These can't be fixed in code (regenerated every build, already// <auto-generated>). The repo already carriedpaths-ignore: **/obj/**, but under an explicitdotnet buildGitHub applies no path filter to a compiled language, so that exclusion was silently inert.codeql.ymlnow usesbuild-mode: none, matching the updated §4.4 template verbatim. Buildless extraction honourspaths-ignore, so theobj/exclusion finally takes effect, and it reads source across all TFMs at once instead of one build's output. The Setup .NET / Restore / Build steps are removed.Behaviour-preserving: no public API or rendered output changed.
Standards alignment
codeql.ymlis now identical totemplates/.github/workflows/codeql.yml.ci.yml,dependabot-auto-merge.yml,Directory.Build.props,global.jsonverified against templates — no other drift.Verification
dotnet build -c Release— clean, 0 warnings (TreatWarningsAsErrorson).dotnet test -c Release— 80/80 pass onnet8.0andnet10.0.obj/alerts will auto-close once the updated CodeQL workflow runs onmainpost-merge.🤖 Generated with Claude Code