From 97e9748048874f9f846e9df2260ca9a43c146f6c Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Mon, 14 Sep 2026 15:57:24 -0700 Subject: [PATCH 1/3] ci(codeql): exclude noisy Python import-cycle queries --- .github/codeql/codeql-config.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 36d70c1d746..b1162a38a38 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -14,6 +14,12 @@ query-filters: id: py/clear-text-logging-sensitive-data # CWE-312 - exclude: id: py/polynomial-redos # CWE-730 + # Import resolution confuses stdlib types with management_endpoints/types.py. + # The generic cycle query also reports intentional deferred imports. + - exclude: + id: py/cyclic-import + - exclude: + id: py/unsafe-cyclic-import paths-ignore: - tests From 270ce9d8ca6e58ceb205baa9e05df44a65610890 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Mon, 14 Sep 2026 16:01:12 -0700 Subject: [PATCH 2/3] ci(codeql): exclude remaining audited Python query categories --- .github/codeql/codeql-config.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index b1162a38a38..1c3da4839a0 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -20,6 +20,14 @@ query-filters: id: py/cyclic-import - exclude: id: py/unsafe-cyclic-import + # Disable repeated logging findings, including genuine log-injection findings. + - exclude: + id: py/log-injection + # Known false positives on live settings and Protocol placeholders. + - exclude: + id: py/unused-global-variable + - exclude: + id: py/ineffectual-statement paths-ignore: - tests From 15fdc5f0f0f1d316160451e59b3c03dcc9ab11a3 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Mon, 14 Sep 2026 16:09:27 -0700 Subject: [PATCH 3/3] ci(codeql): retain Python log-injection coverage --- .github/codeql/codeql-config.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 1c3da4839a0..6e15c1069a3 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -20,9 +20,6 @@ query-filters: id: py/cyclic-import - exclude: id: py/unsafe-cyclic-import - # Disable repeated logging findings, including genuine log-injection findings. - - exclude: - id: py/log-injection # Known false positives on live settings and Protocol placeholders. - exclude: id: py/unused-global-variable