ci(codeql): honor alert suppression comments

Merged
JI
4d ago
+5-0

CodeQL reported two false positives, and the SAST policies failed on them:

  • go/cookie-secure-not-set in casredirect.go: the cookie sets Secure: true, and changes it only in development mode.
  • go/unsafe-quoting in redaction.go: encodeStringBody escapes the string first, and the code only decodes it as JSON.

A // codeql[<query-id>] comment marks an alert as suppressed in the SARIF only when the CodeQL alert suppression query runs. The default queries do not include it.

  • The CodeQL workflow now also runs codeql/go-queries:AlertSuppression.ql. The default queries still run.
  • Each false positive has a suppression comment with the reason.

The SAST policies skip these suppressed CodeQL findings after chainloop-dev/compliance-manifests#427.

Refs PFM-8051.

AI disclosure: Claude Code helped to triage the findings and to write this change.