From fcc4319ab9c6a381b4e166370f4e19fc4f087da4 Mon Sep 17 00:00:00 2001
From: HuangWenjie <zhoudeng.hwj@alibaba-inc.com>
Date: Thu, 7 May 2026 17:48:46 +0800
Subject: [PATCH] fix: address CodeQL warnings on include-extractor

- Remove unused HEADER_GLOB constant in include-extractor.ts
- Use fs.mkdtempSync for secure temp dir creation in tests
  (CodeQL: 'Insecure temporary file')
---
 gitnexus/src/core/group/extractors/include-extractor.ts | 1 -
 gitnexus/test/unit/group/include-extractor.test.ts      | 9 +++------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/gitnexus/src/core/group/extractors/include-extractor.ts b/gitnexus/src/core/group/extractors/include-extractor.ts
index ade0848f2..5d922924a 100644
--- a/gitnexus/src/core/group/extractors/include-extractor.ts
+++ b/gitnexus/src/core/group/extractors/include-extractor.ts
@@ -32,7 +32,6 @@ import {
 
 const HEADER_EXTENSIONS = new Set(['.h', '.hpp', '.hxx', '.hh']);
 
-const HEADER_GLOB = '**/*.{h,hpp,hxx,hh}';
 const SOURCE_GLOB = '**/*.{c,cpp,cc,cxx,h,hpp,hxx,hh}';
 
 const STANDARD_IGNORES = [
diff --git a/gitnexus/test/unit/group/include-extractor.test.ts b/gitnexus/test/unit/group/include-extractor.test.ts
index 49dcf0600..7bf71a6f0 100644
--- a/gitnexus/test/unit/group/include-extractor.test.ts
+++ b/gitnexus/test/unit/group/include-extractor.test.ts
@@ -11,8 +11,7 @@ describe('IncludeExtractor', () => {
   let extractor: IncludeExtractor;
 
   beforeEach(() => {
-    tmpDir = path.join(os.tmpdir(), `gitnexus-include-${Date.now()}`);
-    fs.mkdirSync(tmpDir, { recursive: true });
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gitnexus-include-'));
     extractor = new IncludeExtractor();
   });
 
@@ -164,15 +163,13 @@ int main() { return 0; }`,
   describe('cross-repo matching', () => {
     it('provider and consumer produce matching contractIds', async () => {
       // Simulate provider repo (header-only)
-      const providerDir = path.join(os.tmpdir(), `gitnexus-include-provider-${Date.now()}`);
-      fs.mkdirSync(providerDir, { recursive: true });
+      const providerDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gitnexus-include-provider-'));
       const providerFile = path.join(providerDir, 'map/base/dice_map_view.h');
       fs.mkdirSync(path.dirname(providerFile), { recursive: true });
       fs.writeFileSync(providerFile, '#pragma once\nclass DiceMapView {};');
 
       // Simulate consumer repo
-      const consumerDir = path.join(os.tmpdir(), `gitnexus-include-consumer-${Date.now()}`);
-      fs.mkdirSync(consumerDir, { recursive: true });
+      const consumerDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gitnexus-include-consumer-'));
       const consumerFile = path.join(consumerDir, 'src/controller.cpp');
       fs.mkdirSync(path.dirname(consumerFile), { recursive: true });
       fs.writeFileSync(consumerFile, '#include "map/base/dice_map_view.h"\nvoid init() {}');