docs(backlog): the CodeQL generated-code noise recurred under a new rule - #295
Merged
Merged
Conversation
PR #292 excluded cs/nested-if-statements after it fired twice on regex source-generator output. The next master scan produced #310/#311 — cs/useless-assignment-to-local, same generated file. Four alerts, two rules, one cause: the C# extractor analyses compilation units from the build, so generated code has no checkout file for paths-ignore to match, and every maintainability rule in the suite is a candidate. Recording rather than adding a third exclusion. The mechanism fix is to drop the quality half of the query suite (security-and-quality -> security-extended), which fits how this repo already divides the work: SonarCloud owns quality and analyses real source, CodeQL owns security. Left to the maintainer because it narrows what a security scanner reports. The four alerts are dismissed with that reasoning meanwhile, so the repo's open count stays at 0. Docs only.
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs only.
What happened
PR #292 excluded
cs/nested-if-statementsafter it fired twice onSystem.Text.RegularExpressionssource-generator output. The next master scan produced#310/#311—cs/useless-assignment-to-local, the same generated file.cs/nested-if-statementscs/nested-if-statementscs/useless-assignment-to-localFour alerts, two rules, one cause: the C# extractor analyses compilation units from the build, so generated code has no checkout file for
paths-ignoreto match — and every maintainability rule in the suite is a candidate to fire on it. My own #292 fix treated the symptom.What I am not doing
A third exclusion. That is whack-a-mole, and the pattern is now established well enough to say so.
The mechanism fix, left to you
queries: security-and-qualityin.github/workflows/codeql.ymlis what pulls in maintainability rules like these two.security-extendedkeeps every security query and drops the class entirely.That fits how this repo already divides the work — SonarCloud owns quality (and analyses real source, not build output), CodeQL owns security.
Not doing it autonomously: it narrows what a security scanner reports, which is not a call to make quietly. The four alerts are dismissed with this reasoning meanwhile, so the repository's open-alert count stays at 0.