From 41fa1c87b901f537edf16e152407eb738291b0bb Mon Sep 17 00:00:00 2001
From: Sebastian Mendel <sebastian.mendel@netresearch.de>
Date: Thu, 6 Aug 2026 10:32:19 +0200
Subject: [PATCH] Exclude vendored code from CodeQL, keep tests in scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Re-enabling JavaScript analysis surfaced 14 alerts across the t3x fleet.
Four of them are the same rule, js/bad-tag-filter, inside one vendored
file: Resources/Public/JavaScript/Vendor/marked.esm.js in
netresearch/t3x-nr-mcp-agent. That is a third-party parser we ship and do
not maintain. It cannot be fixed in the consuming repository — the remedy
is a version bump — and until then it crowds out the alerts that are
actionable.

The init step therefore ignores vendored trees: **/Vendor/**,
**/vendor/**, **/node_modules/** and .Build/**.

Test paths are deliberately NOT excluded, and that is the more important
half of this change. The first real finding this analysis produced was a
credential logged in clear text by a Playwright login helper
(netresearch/t3x-contexts, fixed in 07812f2a) — test code writes to CI
logs like any other code, and excluding it would have hidden exactly the
kind of leak the scanner exists to catch.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
---
 .github/workflows/codeql.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index da2653e..9f98488 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -179,11 +179,27 @@ jobs:
         with:
           persist-credentials: false
 
+      # Vendored third-party code is excluded, our own code is not — including
+      # tests. A finding in a library we ship but do not maintain cannot be
+      # fixed here; the remedy is a version bump, and until then the alert
+      # crowds out the ones that are actionable. Measured 2026-08-06: 4 of the
+      # 14 open JavaScript alerts across the t3x fleet were `js/bad-tag-filter`
+      # inside a single vendored `marked.esm.js`.
+      #
+      # Test paths are deliberately NOT excluded. The first real finding this
+      # analysis produced was clear-text logging of a credential in a Playwright
+      # login helper — test code leaks into CI logs like any other code.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
+          config: |
+            paths-ignore:
+              - '**/Vendor/**'
+              - '**/vendor/**'
+              - '**/node_modules/**'
+              - '.Build/**'
 
       - name: Run Go pre-build command
         if: ${{ matrix.language == 'go' && inputs.pre-build-cmd-go != '' }}