diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index bf54c670..12876372 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -39,6 +39,18 @@ paths-ignore: # fix a generator, not the file. - "**/*.generated.cs" + # .NET build artifacts. The `obj/` and `bin/` trees contain + # generated test scaffolding (xunit auto-generated entry + # points: `XunitAutoGeneratedEntry*.cs`) and compiler + # intermediates that aren't authored source. CodeQL findings + # here ask us to fix MSBuild's output, not the source — + # which is the wrong dependency direction. Empirically + # discovered 2026-04-28 (B-0073): two open csharp alerts on + # `obj/Release/net10.0/XunitAutoGenerated*.cs` were gating + # the LFG `code_quality:severity=all` ruleset on every PR. + - "**/obj/**" + - "**/bin/**" + # Custom query packs — reserved for the follow-up round that # ships Zeta-specific taint / CWE rules. The formal- # verification-expert (Soraya) routes the rule authoring