From 25d803e1d62c553ba3d7c3e89c671bf58402d2e5 Mon Sep 17 00:00:00 2001 From: bluezr Date: Thu, 6 Aug 2026 14:37:59 -0700 Subject: [PATCH] ci: scope CodeQL to first-party code Fifteen of the forty-eight open CodeQL alerts are in vendored code -- 7 in secp256k1 and 8 in lodepng. Nobody is going to act on the secp256k1 ones: a finding there is fixed by taking a newer upstream, not by editing our copy. They dilute the list that does need attention, which is how a security tab stops getting read. Worth being precise about why this needs a config file at all. ql.yml already has a paths-ignore, but that is under `on:` -- it decides which file changes trigger a run. Restricting what CodeQL analyses is a different setting and lives in a config file passed to github/codeql-action/init. The exclusions mirror the -i list in cppcheck.yml deliberately rather than by coincidence. Someone already reasoned about which of this tree's vendored code is ours to maintain; agreeing with that decision keeps the two analysers describing the same codebase, and means a finding either matters in both or neither. Note what is not excluded. src/png.c (lodepng) and src/qr.c (qrcodegen) are single-file libraries vendored into the tree and, in practice, maintained here: qr.c has already needed a local fix for table indexing guarded only by an assert, which compiles out under NDEBUG. Excluding those would have hidden a real bug, so they stay in scope. cppcheck excludes neither, and this matches. Expected effect: 48 alerts to 41, all of them in code this project can actually change. The 8 lodepng alerts remain, and have been triaged -- the invalid-pointer-deref at png.c:908 is an OOM path present verbatim in current upstream lodepng, on an encoder we drive with our own data, and libdogecoin never calls the PNG decoder at all. One caveat for review: paths-ignore is supported for compiled languages but does not behave identically to interpreted ones, since CodeQL sees what the build compiles. If secp256k1 alerts survive the next run, the exclusion needs to happen at build time instead, and that is worth watching on the first analysis after merge rather than assuming. --- .github/codeql/codeql-config.yml | 22 ++++++++++++++++++++++ .github/workflows/ql.yml | 1 + 2 files changed, 23 insertions(+) create mode 100644 .github/codeql/codeql-config.yml diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 000000000..bcea5b4e4 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,22 @@ +# CodeQL analysis scope. +# +# The exclusions below mirror the -i list in .github/workflows/cppcheck.yml, +# deliberately rather than coincidentally: these are upstream dependencies we +# track and update wholesale, not code we patch. A finding in them is fixed by +# taking a newer release, not by editing our copy, so an alert here is noise +# that dilutes the ones we can act on. +# +# Note what is NOT excluded. src/png.c (lodepng) and src/qr.c (qrcodegen) are +# single-file libraries vendored into the tree and maintained here in practice +# -- qr.c has already needed a local fix for table indexing guarded only by an +# assert, which compiles out under NDEBUG. Excluding those would have hidden a +# real bug, so they stay in scope. + +name: "libdogecoin CodeQL config" + +paths-ignore: + - src/secp256k1 + - src/libevent + - src/intel + - src/utf8proc.c + - src/utf8proc_data.c diff --git a/.github/workflows/ql.yml b/.github/workflows/ql.yml index 1f35e91b8..7a1fefdb6 100755 --- a/.github/workflows/ql.yml +++ b/.github/workflows/ql.yml @@ -59,6 +59,7 @@ jobs: with: languages: ${{ matrix.language }} queries: security-extended + config-file: ./.github/codeql/codeql-config.yml - name: build libdogecoin run: |