From 67a969d9534514c6700bdefc8a7db58cbac06d0c Mon Sep 17 00:00:00 2001
From: splitsec2 <35583321+splitsec2@users.noreply.github.com>
Date: Fri, 23 Oct 2026 12:35:31 -0600
Subject: [PATCH] ci(codeql): skip the tests directory (#1557)

CodeQL scans `tests/`, which only runs in CI and the e2e docker stack.
That is where the open `py/full-ssrf` (critical) and the two
`py/reflective-xss` alerts come from, all in the e2e mock server, plus
four `py/incomplete-url-substring-sanitization` alerts on URL asserts.
None of them can reach a running instance.

This adds `.github/codeql/codeql-config.yml` with `paths-ignore: tests`
and points the init step at it. It closes those seven and hides nothing
in `shelfmark/` or the frontend. The rest of the open alerts are
unchanged.

@calibrain I know I have ability to merge this, but wanted you to be the
one for this. It clears the test alerts and leaves the rest, and
prevents you from having to clear them manually. Just a little QoL.
---
 .github/codeql/codeql-config.yml | 6 ++++++
 .github/workflows/codeql.yml     | 1 +
 2 files changed, 7 insertions(+)
 create mode 100644 .github/codeql/codeql-config.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..74c959c3
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,6 @@
+name: Shelfmark CodeQL configuration
+
+# Test code only runs in CI and the e2e docker stack (mock servers, URL asserts), so its
+# findings are noise. Skipping it drops those alerts without hiding anything in the app.
+paths-ignore:
+  - tests
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 611bb0fc..4fe12867 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,6 +28,7 @@ jobs:
         uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
         with:
           languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v3