GeezerVison is showing github.com — sim/.github/codeql/codeql-config.yml at main · simstudioai/sim

Expand file tree

codeql-config.yml

Copy path

More file actions

Latest commit

History

43 lines (41 loc) · 1.87 KB

codeql-config.yml

Copy path

File metadata and controls

43 lines (41 loc) · 1.87 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

name: Sim CodeQL config

# Trims the extraction surface. CodeQL parses every matching file into a

# database before a single query runs, and that phase dominates runtime on a

# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so

# excluding it costs no real coverage.

# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`

# filter is separate and decides whether the run happens at all.

paths-ignore:

- '**/*.test.ts'

- '**/*.test.tsx'

- '**/*.test.js'

- '**/*.spec.ts'

- '**/*.spec.tsx'

- '**/__tests__/**'

- '**/__mocks__/**'

- '**/__fixtures__/**'

- '**/__integration__/**'

- '**/*.integration.ts'

- '**/e2e/**'

# Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a

# routable Next.js path segment, not necessarily test code: those globs

# excluded the real endpoint

# apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,

# which authorizes, decrypts destination credentials, and makes an outbound

# request. CodeQL's paths-ignore has no `!` negation to carve it back out

# ("The filter pattern characters ?, +, [, ], and ! are not supported and will

# be matched literally"), and the globs only covered 76 of 12,716 files, so

# the naming convention above is the safer filter.

- '**/*.d.ts'

- '**/node_modules/**'

- '**/dist/**'

- '**/.next/**'

- 'apps/docs/content/**'

# Do NOT add `queries:`, `packs:`, `query-filters:`, or `disable-default-queries`

# here to try to speed the scan up. Under the code-scanning feature flag the

# action's checkOverlayAnalysisFeatureEnabled treats any of those as

# OverlayDisabledReason.NonDefaultQueries and permanently turns off overlay

# (incremental) analysis. Extraction is ~53% of a run and is exactly what overlay

# skips, so scoping the queries trades a documented up-to-10x win for a few

# percent off the 27% query phase.