Quiet known-noise CodeQL alerts without losing coverage

Merged
JE
2mo ago
+51-33

The security-alert cleanup sweep found 58 of this repo's 66 open CodeQL alerts came from three noise sources, none of them defects. This mutes each at the source rather than by perpetual dismissal:

  • Generated Python (24× py/unused-import, all in generated/services/): handled exactly as the config file's own comment prescribes — the SARIF filter now strips python/src/basecamp/generated/ with a (?!services/_) lookahead, so the hand-written services/_base.py and services/_async_base.py stay scanned. Regex verified against representative paths (generated files stripped, the two _ files and auth.py untouched).
  • python/tests/ (26 alerts: empty excepts, unreachable statements, unused locals, plus two false-positive py/incomplete-url-substring-sanitization highs on \"https://3.basecamp.com\" in url assertions): added to paths-ignore under the existing test-infrastructure entries.
  • py/ineffectual-statement (8 alerts): every hit is a ... Protocol/overload stub body in auth.py/async_auth.py — idiomatic typing code the query mistakes for a defect, growing with every future Protocol method. Excluded via query-filters, mirroring the existing java/class-name-matches-super-class precedent.

The existing open alerts in these categories were already dismissed with matching reasons; this change keeps them from coming back. The remaining 8 open alerts (Scorecard process findings) are untouched.

Summary by cubic

Quiets 58 known-noise CodeQL alerts without losing coverage of the hand-written Python service bases. Previously, generated Python, tests, and the py/ineffectual-statement query reopened false positives; now they are filtered or excluded.

  • SARIF filter: centralized in .github/codeql/sarif-filter.jq and used by the workflow; the test now runs the same program. Drops python/src/basecamp/generated/ results except generated/services/_ via a lookahead so _base.py and _async_base.py stay scanned; fixture asserts both are kept.
  • Ignore tests: add python/tests/ to paths-ignore.
  • Query exclusion: add py/ineffectual-statement to query-filters to avoid Protocol/overload ... stub false positives.
  • Existing dismissed alerts in these categories will not return; the remaining 8 Scorecard alerts are unchanged. No migration required.