-
Notifications
You must be signed in to change notification settings - Fork 3.8k
Expand file tree
/
Copy pathcodeql-config.yml
More file actions
43 lines (41 loc) · 1.87 KB
/
Copy pathcodeql-config.yml
File metadata and controls
43 lines (41 loc) · 1.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
name: Sim CodeQL config
# Trims the extraction surface. CodeQL parses every matching file into a
# database before a single query runs, and that phase dominates runtime on a
# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so
# excluding it costs no real coverage.
#
# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`
# filter is separate and decides whether the run happens at all.
paths-ignore:
- '**/*.test.ts'
- '**/*.test.tsx'
- '**/*.test.js'
- '**/*.spec.ts'
- '**/*.spec.tsx'
- '**/__tests__/**'
- '**/__mocks__/**'
- '**/__fixtures__/**'
- '**/__integration__/**'
- '**/*.integration.ts'
- '**/e2e/**'
# Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
# routable Next.js path segment, not necessarily test code: those globs
# excluded the real endpoint
# apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
# which authorizes, decrypts destination credentials, and makes an outbound
# request. CodeQL's paths-ignore has no `!` negation to carve it back out
# ("The filter pattern characters ?, +, [, ], and ! are not supported and will
# be matched literally"), and the globs only covered 76 of 12,716 files, so
# the naming convention above is the safer filter.
- '**/*.d.ts'
- '**/node_modules/**'
- '**/dist/**'
- '**/.next/**'
- 'apps/docs/content/**'
# Do NOT add `queries:`, `packs:`, `query-filters:`, or `disable-default-queries`
# here to try to speed the scan up. Under the code-scanning feature flag the
# action's checkOverlayAnalysisFeatureEnabled treats any of those as
# OverlayDisabledReason.NonDefaultQueries and permanently turns off overlay
# (incremental) analysis. Extraction is ~53% of a run and is exactly what overlay
# skips, so scoping the queries trades a documented up-to-10x win for a few
# percent off the 27% query phase.